PT-2026-69021 · Root+1 · @Rootio/Pdfjs-Dist+1

CVE-2026-16633

·

Published

2026-08-06

·

Updated

2026-08-14

CVSS v4.0

8.6

High

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions pdfjs-dist (affected versions not specified)
Description When enableScripting is set to true and no Content Security Policy (CSP) is configured to disallow script-src, loading a malicious PDF can lead to the execution of unrestricted attacker-controlled JavaScript within the context of the hosting domain.
Recommendations Set enableScripting to false. Implement a Content Security Policy (CSP) to disallow script-src.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-16633
GHSA-HQ66-CQWQ-W95J

Affected Products

@Rootio/Pdfjs-Dist
Pdfjs-Dist