AIKIDO-2024-10104
ngx-extended-pdf-viewer is vulnerable to Eval Injection
75
High Risk
This Affects:
ngx-extended-pdf-viewerTL;DR
Affected versions of the package are vulnerable to eval injection. If pdf.js is used to load a malicious PDF and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ngx-extended-pdf-viewer is vulnerable to Eval Injection in versions 0.0.1 - 20.0.2.
How to fix this
Upgrade the ngx-extended-pdf-viewer library to the patch version.
Links
GitHub Release
Other
github.com/stephanrauh/ngx-extended-pdf-viewer/compare/stephanrauh:9b105d3...stephanrauh:dbceda9
bugzilla.mozilla.org/show_bug.cgi?id=1893645lists.debian.org/debian-lts-announce/2024/05/msg00010.htmllists.debian.org/debian-lts-announce/2024/05/msg00012.htmlmozilla.org/security/advisories/mfsa2024-21/mozilla.org/security/advisories/mfsa2024-22/mozilla.org/security/advisories/mfsa2024-23/seclists.org/fulldisclosure/2024/Aug/30codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/exploit-db.com/exploits/52273cert-portal.siemens.com/productcert/html/ssa-827383.html
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.