CVE-2026-16633: XSS
Published Aug 6, 2026
·Updated
Impact
If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
Workarounds Set enableScripting to false or set a CSP.
Affected Software
1 affected componentFixes available
npm/pdfjs-dist>=5.6.83<6.2.108
6.2.108
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/pdfjs-distto a version that resolves this vulnerability.Fixed in 6.2.108 - Configuration
Set PDF.js `enableScripting` to `false` (default is `true`).
PDF.js enableScripting = false - Configuration
Configure a Content-Security-Policy (CSP) on the hosting domain to disallow `script-src` so attacker-controlled JavaScript is blocked.
PDF.js / hosting web app (CSP) Content-Security-Policy (CSP) script-src = disallow script-src (set CSP to disallow script execution)
Event History
Aug 6, 2026
Advisory Published
via GitHub·09:12 PM
Data Sourced
via GitHub·09:12 PM
DescriptionWeaknessAffected Software