{"id":"GHSA-4m3g-6r7g-jv4f","aliases":[],"status":"published","title":"Arbitrary JavaScript execution due to using outdated libraries","description":"### Summary\ngradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.\n\n### PoC\n1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.)\n[poc.pdf](https://github.com/user-attachments/files/15516798/poc.pdf)\n\n2. Run the app. In this PoC, I've used the demo for a simple proof.\n![1](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/d1bb7626-3d0f-4984-8873-297658d6e77e)\n\n3. Upload a PDF file containing the script.\n![2](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/803d8080-c946-446e-bb34-cf5640e1b4de)\n\n4. Check that the script is running.\n![3](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/4956b95f-acca-4bb1-a3c2-7dfc96adf890)\n\n\n### Impact\nMalicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.\n\n### Mitigation\nUpgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option `isEvalSupported` to `false`.)\n\n### Reference\n1. https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/\n2. https://github.com/mozilla/pdf.js/pull/18015","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-06-05T14:15:50Z","modified":"2024-12-02T05:49:21Z","fixes":[{"ecosystem":"PyPI","package":"gradio-pdf","fixed_in":["0.0.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gradio-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gradio-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]}],"references":[{"url":"https://github.com/freddyaboulton/gradio-pdf/security/advisories/GHSA-4m3g-6r7g-jv4f","tags":["web"]},{"url":"https://github.com/freddyaboulton/gradio-pdf/commit/67edd0c625fae7b855186727ee9678297602ee45","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4m3g-6r7g-jv4f"},{"url":"https://github.com/freddyaboulton/gradio-pdf","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-4m3g-6r7g-jv4f","title":"Arbitrary JavaScript execution due to using outdated libraries","description":"### Summary\ngradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.\n\n### PoC\n1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.)\n[poc.pdf](https://github.com/user-attachments/files/15516798/poc.pdf)\n\n2. Run the app. In this PoC, I've used the demo for a simple proof.\n![1](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/d1bb7626-3d0f-4984-8873-297658d6e77e)\n\n3. Upload a PDF file containing the script.\n![2](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/803d8080-c946-446e-bb34-cf5640e1b4de)\n\n4. Check that the script is running.\n![3](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/4956b95f-acca-4bb1-a3c2-7dfc96adf890)\n\n\n### Impact\nMalicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.\n\n### Mitigation\nUpgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option `isEvalSupported` to `false`.)\n\n### Reference\n1. https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/\n2. https://github.com/mozilla/pdf.js/pull/18015","status":"published","published":"2024-06-05T14:15:50Z","modified":"2024-06-05T14:15:51Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:53.025064Z"}],"osv":[{"id":"GHSA-4m3g-6r7g-jv4f","title":"Arbitrary JavaScript execution due to using outdated libraries","description":"### Summary\ngradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.\n\n### PoC\n1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.)\n[poc.pdf](https://github.com/user-attachments/files/15516798/poc.pdf)\n\n2. Run the app. In this PoC, I've used the demo for a simple proof.\n![1](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/d1bb7626-3d0f-4984-8873-297658d6e77e)\n\n3. Upload a PDF file containing the script.\n![2](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/803d8080-c946-446e-bb34-cf5640e1b4de)\n\n4. Check that the script is running.\n![3](https://github.com/freddyaboulton/gradio-pdf/assets/114328108/4956b95f-acca-4bb1-a3c2-7dfc96adf890)\n\n\n### Impact\nMalicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.\n\n### Mitigation\nUpgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option `isEvalSupported` to `false`.)\n\n### Reference\n1. https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/\n2. https://github.com/mozilla/pdf.js/pull/18015","status":"published","published":"2024-06-05T14:15:50Z","modified":"2024-12-02T05:49:21.567066Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}