---
id: CVE-2026-16633
aliases:
  - GHSA-hq66-cqwq-w95j
title: 'PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF '
summary: 'PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF '
severity: high
cwe:
  - CWE-79
vendor: pdfjs-dist
product: pdfjs-dist
ecosystem: npm
affected:
  - 'pdfjs-dist >= 5.6.83, < 6.2.108'
patched:
  - pdfjs-dist 6.2.108
published: '2026-08-06'
updated: '2026-08-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hq66-cqwq-w95j'
references:
  - url: 'https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j'
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2055885'
  - url: 'https://github.com/advisories/GHSA-hq66-cqwq-w95j'
tags:
  - ghsa
  - npm
ingestedAt: '2026-08-06T22:05:23.307Z'
---

## Overview

### Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

### Patches

### Workarounds
Set `enableScripting` to `false` or set a CSP.

## Affected packages

- `pdfjs-dist >= 5.6.83, < 6.2.108`

## Remediation

Upgrade to a patched release:

- `pdfjs-dist 6.2.108`