Skip to content

Commit 5d563bc

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Auto-update jsrepository: pdfjs-dist | GHSA-hq66-cqwq-w95j (#612)
Updated libraries (1): pdfjs-dist Updated vulnerability IDs (1): GHSA-hq66-cqwq-w95j Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 3b8db9d commit 5d563bc

9 files changed

Lines changed: 178 additions & 0 deletions

‎repository/jsrepository-master.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12384,6 +12384,30 @@
1238412384
"http://www.securityfocus.com/bid/104136",
1238512385
"http://www.securitytracker.com/id/1040896"
1238612386
]
12387+
},
12388+
{
12389+
"ranges": [
12390+
{
12391+
"atOrAbove": "5.6.83",
12392+
"below": "6.2.108"
12393+
}
12394+
],
12395+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
12396+
"details": "### Impact\n\nIf PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.\n\n### Patches\n\n### Workarounds\nSet `enableScripting` to `false` or set a CSP.",
12397+
"identifiers": {
12398+
"githubID": "GHSA-hq66-cqwq-w95j",
12399+
"CVE": [
12400+
"CVE-2026-16633"
12401+
]
12402+
},
12403+
"severity": "high",
12404+
"cwe": [
12405+
"CWE-79"
12406+
],
12407+
"info": [
12408+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
12409+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
12410+
]
1238712411
}
1238812412
],
1238912413
"extractors": {

‎repository/jsrepository-v2.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14059,6 +14059,25 @@
1405914059
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1406014060
"https://github.com/mozilla/pdf.js"
1406114061
]
14062+
},
14063+
{
14064+
"atOrAbove": "5.6.83",
14065+
"below": "6.2.108",
14066+
"severity": "high",
14067+
"cwe": [
14068+
"CWE-79"
14069+
],
14070+
"identifiers": {
14071+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14072+
"githubID": "GHSA-hq66-cqwq-w95j",
14073+
"CVE": [
14074+
"CVE-2026-16633"
14075+
]
14076+
},
14077+
"info": [
14078+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14079+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14080+
]
1406214081
}
1406314082
],
1406414083
"extractors": {

‎repository/jsrepository-v3.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14256,6 +14256,25 @@
1425614256
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1425714257
"https://github.com/mozilla/pdf.js"
1425814258
]
14259+
},
14260+
{
14261+
"atOrAbove": "5.6.83",
14262+
"below": "6.2.108",
14263+
"severity": "high",
14264+
"cwe": [
14265+
"CWE-79"
14266+
],
14267+
"identifiers": {
14268+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14269+
"githubID": "GHSA-hq66-cqwq-w95j",
14270+
"CVE": [
14271+
"CVE-2026-16633"
14272+
]
14273+
},
14274+
"info": [
14275+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14276+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14277+
]
1425914278
}
1426014279
],
1426114280
"extractors": {

‎repository/jsrepository-v4.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14255,6 +14255,25 @@
1425514255
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1425614256
"https://github.com/mozilla/pdf.js"
1425714257
]
14258+
},
14259+
{
14260+
"atOrAbove": "5.6.83",
14261+
"below": "6.2.108",
14262+
"severity": "high",
14263+
"cwe": [
14264+
"CWE-79"
14265+
],
14266+
"identifiers": {
14267+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14268+
"githubID": "GHSA-hq66-cqwq-w95j",
14269+
"CVE": [
14270+
"CVE-2026-16633"
14271+
]
14272+
},
14273+
"info": [
14274+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14275+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14276+
]
1425814277
}
1425914278
],
1426014279
"extractors": {

‎repository/jsrepository-v5-combined.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14262,6 +14262,25 @@
1426214262
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1426314263
"https://github.com/mozilla/pdf.js"
1426414264
]
14265+
},
14266+
{
14267+
"atOrAbove": "5.6.83",
14268+
"below": "6.2.108",
14269+
"severity": "high",
14270+
"cwe": [
14271+
"CWE-79"
14272+
],
14273+
"identifiers": {
14274+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14275+
"githubID": "GHSA-hq66-cqwq-w95j",
14276+
"CVE": [
14277+
"CVE-2026-16633"
14278+
]
14279+
},
14280+
"info": [
14281+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14282+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14283+
]
1426514284
}
1426614285
],
1426714286
"extractors": {

‎repository/jsrepository-v5.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14261,6 +14261,25 @@
1426114261
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1426214262
"https://github.com/mozilla/pdf.js"
1426314263
]
14264+
},
14265+
{
14266+
"atOrAbove": "5.6.83",
14267+
"below": "6.2.108",
14268+
"severity": "high",
14269+
"cwe": [
14270+
"CWE-79"
14271+
],
14272+
"identifiers": {
14273+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14274+
"githubID": "GHSA-hq66-cqwq-w95j",
14275+
"CVE": [
14276+
"CVE-2026-16633"
14277+
]
14278+
},
14279+
"info": [
14280+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14281+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14282+
]
1426414283
}
1426514284
],
1426614285
"extractors": {

‎repository/jsrepository-v6-combined.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14532,6 +14532,26 @@
1453214532
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1453314533
"https://github.com/mozilla/pdf.js"
1453414534
]
14535+
},
14536+
{
14537+
"atOrAbove": "5.6.83",
14538+
"below": "6.2.108",
14539+
"severity": "high",
14540+
"cwe": [
14541+
"CWE-79"
14542+
],
14543+
"identifiers": {
14544+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14545+
"githubID": "GHSA-hq66-cqwq-w95j",
14546+
"CVE": [
14547+
"CVE-2026-16633"
14548+
]
14549+
},
14550+
"details": "### Impact\n\nIf PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.\n\n### Patches\n\n### Workarounds\nSet `enableScripting` to `false` or set a CSP.",
14551+
"info": [
14552+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14553+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14554+
]
1453514555
}
1453614556
],
1453714557
"extractors": {

‎repository/jsrepository-v6.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14531,6 +14531,26 @@
1453114531
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1453214532
"https://github.com/mozilla/pdf.js"
1453314533
]
14534+
},
14535+
{
14536+
"atOrAbove": "5.6.83",
14537+
"below": "6.2.108",
14538+
"severity": "high",
14539+
"cwe": [
14540+
"CWE-79"
14541+
],
14542+
"identifiers": {
14543+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
14544+
"githubID": "GHSA-hq66-cqwq-w95j",
14545+
"CVE": [
14546+
"CVE-2026-16633"
14547+
]
14548+
},
14549+
"details": "### Impact\n\nIf PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.\n\n### Patches\n\n### Workarounds\nSet `enableScripting` to `false` or set a CSP.",
14550+
"info": [
14551+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
14552+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
14553+
]
1453414554
}
1453514555
],
1453614556
"extractors": {

‎repository/jsrepository.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13952,6 +13952,25 @@
1395213952
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
1395313953
"https://github.com/mozilla/pdf.js"
1395413954
]
13955+
},
13956+
{
13957+
"atOrAbove": "5.6.83",
13958+
"below": "6.2.108",
13959+
"severity": "high",
13960+
"cwe": [
13961+
"CWE-79"
13962+
],
13963+
"identifiers": {
13964+
"summary": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
13965+
"githubID": "GHSA-hq66-cqwq-w95j",
13966+
"CVE": [
13967+
"CVE-2026-16633"
13968+
]
13969+
},
13970+
"info": [
13971+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
13972+
"https://bugzilla.mozilla.org/show_bug.cgi?id=2055885"
13973+
]
1395513974
}
1395613975
],
1395713976
"extractors": {

0 commit comments

Comments
 (0)