CVE-2024-34342: Pdf.js Viewer Project Pdf.js Viewer

High severity, CVSS 7.1. EPSS: 1.1% chance of exploitation in the next 30 days.

react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.

Affected products

• Pdf.js Viewer Project Pdf.js Viewer
• Wojtekmaj React-PDF: before 7.7.3 (fixed in 7.7.3); from 8.0.0, before 8.0.2 (fixed in 8.0.2)

Published 2024-05-07. Last modified 2026-06-17.