# CVE-2024-4367 vulnerability in pdf.js

**URL:** <https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338>\
**Category:** Technical Support\
**Created:** [July 1, 2024, 8:03pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338 "2024-07-01T20:03:25Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![tgordon](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@tgordon](https://pdfjs.community/u/tgordon)\
**Post date:** [July 3, 2024, 4:57pm UTC](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338/3 "2024-07-03T16:57:56Z")

</div>

Hello webdevops,

Thank you for raising this, we are aware of this vulnerability and have decided to disable the eval in PDF.js that is causing this issue according to the workaround in the CVE

In the meantime disabling embedded javascript will prevent this vulnerability, see this forum post on more information:

> [@XSS execute script in pdf file](https://pdfjs.community/t/xss-execute-script-in-pdf-file/2781/6):
>
> Best Solution. Thanks for your support @kkim .

Best regards,  
Tyler

---

_[View the full topic](https://pdfjs.community/t/cve-2024-4367-vulnerability-in-pdf-js/3338)._