High severityNVD Advisory· Published Aug 6, 2026
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
CVE-2026-16633
Description
Impact
If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
Workarounds
Set enableScripting to false or set a CSP.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pdfjs-distnpm | >= 5.6.83, < 6.2.108 | 6.2.108 |
Affected products
2Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.