GHSA-87hq-q4gp-9wr4

Source

https://github.com/advisories/GHSA-87hq-q4gp-9wr4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-87hq-q4gp-9wr4/GHSA-87hq-q4gp-9wr4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87hq-q4gp-9wr4

Aliases

CVE-2024-34342

Related

CVE-2024-34342

Published

2024-05-07T16:48:59Z

Modified

2025-01-14T12:27:09.790666Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L CVSS Calculator

Summary

react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js

Details

Summary

If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

This patch forces isEvalSupported to false, removing the attack vector.

Workarounds

Set options.isEvalSupported to false, where options is Document component prop.

References

GHSA-wgrm-67xf-hhpq
https://github.com/mozilla/pdf.js/pull/18015
https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2024-05-07T16:48:59Z",
    "nvd_published_at": "2024-05-07T15:15:09Z",
    "severity": "HIGH"
}

References

Affected packages

npm / react-pdf

Package

Name: react-pdf; View open source insights on deps.dev
Purl: pkg:npm/react-pdf

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.7.3