CVE-2024-4367 in PDF.js Allows JavaScript Execution, Potentially Affecting Millions of Websites: Update Now

CVE-2024-4367 in PDF.js Allows JavaScript Execution, Potentially Affecting Millions of Websites: Update Now

Security experts identified a significant vulnerability in PDF.js, a widely used JavaScript library for displaying PDF documents in web browsers, which is actively maintained by Mozilla.

Aside from being an integral component of web browsers like Firefox, PDF.js is also distributed as a module on NPM (Node Package Manager) under the name pdfjs-dist, receiving nearly 2.8 million weekly downloads.

PDF.js (pdjs-dist) on NPM

Although a fixed …

browsers cve cve-2024 documents experts javascript library millions mozilla pdf pdf.js security security experts update update now vulnerability web web browsers websites