概要
PDF viewers often sit in document workflows that handle invoices, contracts, resumes, uploads, and support attachments. When PDF.js is in the affected range, rendering a malicious PDF can execute attacker-controlled JavaScript in the hosting page's origin.
仕組み
The repo check looks for `pdfjs-dist` in npm dependency files and lockfiles. Exact lockfile versions produce high-confidence findings; broad package.json ranges are reported when they clearly allow PDF.js releases up to and including 4.1.392.
被害範囲
If an app renders untrusted PDFs with the vulnerable runtime, attacker-controlled script may run in the browser context that hosts the viewer. Depending on the page, that can expose session data, document content, tenant metadata, or actions available to the signed-in user.
// fixvibeのチェック内容
FixVibeのチェック内容
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Upgrade `pdfjs-dist` to 4.2.67 or newer, regenerate the active lockfile, and rebuild every PDF viewer bundle and worker asset. If untrusted PDFs must be rendered before the upgrade rolls out, use `isEvalSupported: false` where compatible as temporary defense-in-depth.