CVE-2024-34342
react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
- Record
CVE-2024-34342- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-1513
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
- Record
EUVD-2024-1513- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87hq-q4gp-9wr4
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
Summary
If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
This patch forces isEvalSupported to false, removing the attack vector.
Workarounds
Set options.isEvalSupported to false, where options is Document component prop.
References
- Record
GHSA-87hq-q4gp-9wr4- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
- Record
CVE-2024-34342- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
- Record
CVE-2024-34342- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-87hq-q4gp-9wr4
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
Summary
If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
This patch forces isEvalSupported to false, removing the attack vector.
Workarounds
Set options.isEvalSupported to false, where options is Document component prop.
References
- Record
GHSA-87hq-q4gp-9wr4- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVCLSA-2026-1775781167 No score
TuxCare security update for react-pdf (1 CVE)
TuxCare rebuilt react-pdf to address 1 CVE. Fixed in 7.7.1-tuxcare.1.
- Record
CLSA-2026-1775781167- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-34342 No score
CVE-2024-34342 in @rootio/react-pdf - Patched by Root
Root has patched CVE-2024-34342 in the @rootio/react-pdf package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-34342- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-pdfnpm |
before 7.7.3 | 7.7.3 |
react-pdfnpm |
8.0.0 up to 8.0.2 | 8.0.2 |
react-pdfTuxCare:npm |
7.7.1-tuxcare.0 up to 7.7.1-tuxcare.1, plus listed versions 7.7.1 |
7.7.1-tuxcare.1 |
@rootio/react-pdfRoot:npm |
before 5.7.2-root.io.1 | 5.7.2-root.io.15.7.2-root.io.25.7.2-root.io.3 |
react-pdfRoot:npm |
before 5.7.2-aikido.2 | 5.7.2-aikido.25.7.2-aikido.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-34342 is a high vulnerability (CVSS 7.1) in Wojtekmaj React-pdf, published May 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in react-pdf 7.7.3.
References
github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4