{"id":"CVE-2024-34342","published":"2024-05-07T14:29:06Z","modified":"2024-08-02T02:51:10Z","title":"react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF","vendor":"wojtekmaj","product":"react-pdf","tier":"tail","description":{"text":"react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01064,"percentile":0.64539,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq","tags":["x_refsource_MISC"]},{"url":"https://github.com/mozilla/pdf.js/pull/18015","tags":["x_refsource_MISC"]},{"url":"https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6","tags":["x_refsource_MISC"]},{"url":"https://github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe","tags":["x_refsource_MISC"]},{"url":"https://github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad","tags":["x_refsource_MISC"]}],"priority":{"score":17.9,"factors":[{"name":"EPSS percentile","points":12.91},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"wojtekmaj","affectedVersions":[{"vendor":"wojtekmaj","product":"react-pdf","versions":["< 7.7.3",">= 8.0.0, < 8.0.2"]}],"affected":[{"ecosystem":"npm","package":"react-pdf","vulnerableRanges":["<7.7.3",">=8.0.0, <8.0.2"],"patched":["7.7.3","8.0.2"],"from":["GHSA-87hq-q4gp-9wr4"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1513","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-wojtekmaj-react-pdf-cve-2024-34342","children":[{"from":"CVE-2024-34342","to":"CVE-2024-4367","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wgrm-67xf-hhpq","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-87hq-q4gp-9wr4","via":"reference","url":"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq"}]}]}}