# CVE-2024-4367 vulnerability in pdf.js

**URL:** <https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338>\
**Category:** Technical Support\
**Created:** [July 1, 2024, 8:03pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338 "2024-07-01T20:03:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![webdevops](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@webdevops](https://pdfjs.community/u/webdevops)\
**Post date:** [July 1, 2024, 8:03pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338/1 "2024-07-01T20:03:25Z")

</div>

**Which product are you using?**  
PDF.js Express Viewer

**PDF.js Express Version**  
8.7.4

**Detailed description of issue**  
The latest version of pdfjs-express-viewer has critical vulnerability in PDF.js ([PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF · CVE-2024-4367 · GitHub Advisory Database · GitHub](https://github.com/advisories/GHSA-wgrm-67xf-hhpq)) . Are there any plans to release a patch to address this? We are currently using pdfjs-express-viewer in production application and need this to be resolved asap.

---

<div class="post-metadata">

**Author:** ![tgordon](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@tgordon](https://pdfjs.community/u/tgordon)\
**Post date:** [July 3, 2024, 4:57pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338/3 "2024-07-03T16:57:56Z")

</div>

Hello webdevops,

Thank you for raising this, we are aware of this vulnerability and have decided to disable the eval in PDF.js that is causing this issue according to the workaround in the CVE

In the meantime disabling embedded javascript will prevent this vulnerability, see this forum post on more information:

> [@XSS execute script in pdf file](https://pdfjs.community/t/xss-execute-script-in-pdf-file/2781/6):
>
> Best Solution. Thanks for your support @kkim .

Best regards,  
Tyler

---

<div class="post-metadata">

**Author:** ![webdevops](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@webdevops](https://pdfjs.community/u/webdevops)\
**Post date:** [July 3, 2024, 5:29pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338/4 "2024-07-03T17:29:27Z")

</div>

awesome, thank you! We will use your suggestion to disable embedded js.  
Is there an ETA for disabling the eval in pdfjs?

thanks again!

---

<div class="post-metadata">

**Author:** ![tgordon](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@tgordon](https://pdfjs.community/u/tgordon)\
**Post date:** [July 4, 2024, 5:49pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338/5 "2024-07-04T17:49:20Z")

</div>

Hello webdevops,

We just pushed a new version disabling eval per the workaround suggested in the CVE

Best regards,  
Tyler