AIKIDO-2026-169371

TL;DR

pdfjs-dist interpolates untrusted PDF data into CSS, XML, and regex-based parsers without adequate validation. Font family names from the document were inserted into @font-face rules and XFA styles without CSS-string serialization, so a crafted name could inject additional CSS rules into the host page. Several parsers also used super-linear regular expressions (XFA font normalization, autolinker email matching, XFA path positions, and XML entity names) and walked AcroForm Parent chains without detecting cycles, so a crafted PDF could stall the viewer or hang the worker. Invalid XML character references aborted parsing entirely. The fix serializes font families as CSS strings, bounds or anchors the affected regexes, breaks cyclic field walks, and keeps invalid character references as literal text.