CVE-2024-34342 — react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unr…
Published: 2024-05-07 · CVSS: 7.1 · CVSS 3.1
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7