PDF.js < 4.2.67 - Arbitrary JavaScript Execution
mediumPDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can successfully trick a user into opening...
- CVSS:
- 6.4
- Affected:
- up to 1.3.2
- Fix:
- No patched version reported
- Disclosed:
- May 20, 2024