Which versions of PDF.js are affected by CVE-2026-16633?

PDF.js library versions 5.6.83-6.2.107 contain a vulnerability allowing malicious PDFs to execute arbitrary code within web applications, potentially leading to data theft, system compromise, or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16633?

Yes, a public proof-of-concept exploit is available for CVE-2026-16633. Prioritise patching immediately.

How to fix or mitigate CVE-2026-16633?

Within 24 hours, inventory all applications using pdfjs-dist and identify which are running versions 5.6.83 through 6.2.107. Within 7 days, implement Content Security Policy (CSP) headers with restrictive script-src directives on all production applications that process untrusted PDFs, and disable the enableScripting configuration flag where application functionality permits. Within 30 days, monitor PDF.js maintainer advisories for patch availability, plan and test upgrades when released, and if enableScripting cannot be disabled, evaluate alternative PDF rendering libraries with stronger security isolation.

PDF.js CVE-2026-16633

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 https://github.com/mozilla/pdf.js

GHSA-hq66-cqwq-w95j

XSS

Severity by source

vuln.today AI

9.3 CRITICAL

Network-delivered PDF, no attacker privileges, user must open it (UI:R), JS executes in hosting origin (S:C), with full read/write access to that context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 21:36 vuln.today

Analysis Generated

Aug 06, 2026 - 21:36 vuln.today

CVE Published

Aug 06, 2026 - 21:12 cve.org

HIGH

DescriptionCVE.org

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

AnalysisAI

Arbitrary JavaScript execution in PDF.js (pdfjs-dist) allows an attacker to run unrestricted script in the context of any web application that renders attacker-controlled PDFs with default settings. The flaw stems from PDF.js's built-in scripting engine, which is enabled by default via the enableScripting flag, executing embedded JavaScript from PDFs without sandbox enforcement when no script-src CSP is present. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft PDF with embedded JS payload

Delivery

Deliver PDF to victim via phishing or upload

Exploit

Victim opens PDF in vulnerable PDF.js instance

Execution

PDF scripting engine executes attacker JS

Persist

Script runs in hosting domain origin

Impact

Exfiltrate session tokens or perform actions as victim

Access

Craft PDF with embedded JS payload

Delivery

Deliver PDF to victim via phishing or upload

Exploit

Victim opens PDF in vulnerable PDF.js instance

Execution

PDF scripting engine executes attacker JS

Persist

Script runs in hosting domain origin

Impact

Exfiltrate session tokens or perform actions as victim

Vulnerability AssessmentAI

Exploitation	Two conditions must both be present: (1) enableScripting is set to true in the PDF.js configuration - this is the default value, so any application that has not explicitly set enableScripting: false is vulnerable; (2) the page hosting PDF.js does not enforce a Content Security Policy that blocks script-src, meaning either no CSP is present or the existing CSP permits inline scripts or unsafe-eval. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector was provided by NVD or the advisory, so risk signals are inferred. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a PDF file containing embedded JavaScript that exfiltrates session cookies or performs actions on behalf of the victim by sending requests to the hosting application. The attacker distributes this PDF via phishing email, a malicious file upload feature, or a shared document link targeting an application that uses pdfjs-dist with default settings. …
Remediation	The primary fix is to upgrade pdfjs-dist to version 6.2.108 or later, as confirmed by the GHSA advisory at https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j. … Detailed patch versions, workarounds, and compensating controls in full report.