The hook
PDF viewers often sit in document workflows that handle invoices, contracts, resumes, uploads, and support attachments. When PDF.js is in the affected range, rendering a malicious PDF can execute attacker-controlled JavaScript in the hosting page's origin.
Qanday ishlaydi
The repo check looks for `pdfjs-dist` in npm dependency files and lockfiles. Exact lockfile versions produce high-confidence findings; broad package.json ranges are reported when they clearly allow PDF.js releases up to and including 4.1.392.
The blast radius
If an app renders untrusted PDFs with the vulnerable runtime, attacker-controlled script may run in the browser context that hosts the viewer. Depending on the page, that can expose session data, document content, tenant metadata, or actions available to the signed-in user.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade `pdfjs-dist` to 4.2.67 or newer, regenerate the active lockfile, and rebuild every PDF viewer bundle and worker asset. If untrusted PDFs must be rendered before the upgrade rolls out, use `isEvalSupported: false` where compatible as temporary defense-in-depth.