GHSA-4m3g-6r7g-jv4f
Arbitrary JavaScript execution due to using outdated libraries
GHSA-4m3g-6r7g-jv4f is a low vulnerability (CVSS 3.6) in gradio-pdf, published June 5, 2024. No source lists public exploit code. Fixed in gradio-pdf 0.0.10.
- Severity
- 3.6 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.0.10gradio-pdf +1 more
Description
Summary
gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.
PoC
Generate a pdf file with a malicious script in the fontmatrix. (This will run
alert(‘XSS’).) poc.pdfRun the app. In this PoC, I've used the demo for a simple proof.
Upload a PDF file containing the script.
Check that the script is running.
Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
Mitigation
Upgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option isEvalSupported to false.)
Reference
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gradio-pdfPyPI | before 0.0.10 | 0.0.10 |
gradio-pdfPyPI | before 0.0.10, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 4 moreShow less0.0.60.0.70.0.80.0.9 | 0.0.10 |
What each source reports
GitHub Advisories Score used
Arbitrary JavaScript execution due to using outdated libraries
Summary
gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.
PoC
Generate a pdf file with a malicious script in the fontmatrix. (This will run
alert(‘XSS’).) poc.pdfRun the app. In this PoC, I've used the demo for a simple proof.
Upload a PDF file containing the script.
Check that the script is running.
Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
Mitigation
Upgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option isEvalSupported to false.)
Reference
- Record
GHSA-4m3g-6r7g-jv4f- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Arbitrary JavaScript execution due to using outdated libraries
Summary
gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.
PoC
Generate a pdf file with a malicious script in the fontmatrix. (This will run
alert(‘XSS’).) poc.pdfRun the app. In this PoC, I've used the demo for a simple proof.
Upload a PDF file containing the script.
Check that the script is running.
Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
Mitigation
Upgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option isEvalSupported to false.)
Reference
- Record
GHSA-4m3g-6r7g-jv4f- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.