CVE-2021-27517: Foxit Phantompdf

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).

Affected products

• Foxit Phantompdf: up to and including 9.7.5.29616; from 10.0.0.0, up to and including 10.1.3.37598
• Foxit Reader: up to and including 10.1.3.37598

Published 2021-07-20. Last modified 2026-06-17.