Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

ngx-extended-pdf-viewer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmPublished

    ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

    GHSA-w9hm-4m3m-fxmm

    Affected
    • npm ngx-extended-pdf-viewer >= 27.0.0-rc.0, < 29.0.0-rc.3
    Fixed in
    29.0.0-rc.3· Vendor fix available
    Issue
    ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. Impact Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633. Exposure. The sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not — so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe. Patches 29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates. Workarounds Set pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src. Verifying.…

    Recommended action: Upgrade to 29.0.0-rc.3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →