# Security vulnerabilities in PDF.js Express

**URL:** <https://pdfjs.community/t/security-vulnerabilities-in-pdf-js-express/957>\
**Category:** Technical Support\
**Created:** [August 18, 2021, 2:38pm UTC](https://pdfjs.community/t/security-vulnerabilities-in-pdf-js-express/957 "2021-08-18T14:38:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amit.garg](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@amit.garg](https://pdfjs.community/u/amit.garg)\
**Post date:** [August 18, 2021, 2:38pm UTC](https://pdfjs.community/t/security-vulnerabilities-in-pdf-js-express/957/1 "2021-08-18T14:38:25Z")

</div>

[Dependency-Check Report.pdf](https://pdfjs.community/uploads/short-url/h8vasNMdPlFJNXyKYsRdDj22Xox.pdf) (443.9 KB)

**PDF.js Express Version**

**Detailed description of issue**  
We are planning to use PDF.js Express but found some security vulnerabilities in it. (Please see the attached report). Can PDFTron resolve the reported issue so that we can get approval from our security department and use PDF.js Express in our website.

**Expected behaviour**  
{Provide a screenshot or description of the expected behaviour}

**Does your issue happen with every document, or just one?**  
{Answer here}

**Link to document**  
please see the attached report for the list of vulnerabilitiesProcessing: dependency-check-report-PDFjsExpress.html…

**Code snippet**  
{Provide a relevant code snippet}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex031/uploads/pdfjscommunity/original/1X/ffbcd25c7d423db8d5acd5db201c272f4db306dd.png) [@system](https://pdfjs.community/u/system)\
**Post date:** [August 18, 2021, 2:38pm UTC](https://pdfjs.community/t/security-vulnerabilities-in-pdf-js-express/957/2 "2021-08-18T14:38:28Z")

</div>

**Hello, I’m Ron, an automated tech support bot 🤖**

While you wait for one of our customer support representatives to get back to you, please check out some of these documentation pages:

Guides:
- [Annotation samples for PDF.js Express](https://pdfjs.express/documentation/annotation/samples)
- [Searching in PDF.js Express - Get started](https://pdfjs.express/documentation/search/overview#get-started)
- [Browser support for PDF.js Express](https://pdfjs.express/documentation/learn-more/browser-support)

APIs:
- [PDF.js Express Utilities](https://pdfjs.express/api/utils/index.html#__anchor)
- [ExpressUtils(optionsopt) - # async extract() → {Promise.}](https://pdfjs.express/api/utils/ExpressUtils.html#extract__anchor)
- [Adding a download button](https://pdfjs.express/api/utils/tutorial-Adding%20a%20download%20button.html#__anchor)

Forums:
- [I cannot use PDF.JS Express to open a PDF file by url in a Vue Project, please help me figure out how is that happen](https://pdfjs.community/t/i-cannot-use-pdf-js-express-to-open-a-pdf-file-by-url-in-a-vue-project-please-help-me-figure-out-how-is-that-happen/660/1)
- [Annotation goes non responsive(View only) if left still for a week](https://pdfjs.community/t/annotation-goes-non-responsive-view-only-if-left-still-for-a-week/573/1)
- [Undefined is not a valid destination type](https://pdfjs.community/t/undefined-is-not-a-valid-destination-type/809/1)

---

<div class="post-metadata">

**Author:** ![driley](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@driley](https://pdfjs.community/u/driley)\
**Post date:** [August 18, 2021, 6:18pm UTC](https://pdfjs.community/t/security-vulnerabilities-in-pdf-js-express/957/3 "2021-08-18T18:18:00Z")

</div>

Hi Amit,

These dependencies appear to be used to generate our documentation files and are not used by the execution of the actual PDF.js Express WebViewer. What you can do is try deleting the folder `/root/Downloads/pdfjsexpress/doc/*` and see if that helps you pass your security tests. If this does not work for you let me know.

Cheers,  
Dustin