What is GHSA-7j37-5f9j-vw6q?

GHSA-7j37-5f9j-vw6q is a security advisory published by GitHub Security Advisories with High severity. When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field...

Which CVE IDs does GHSA-7j37-5f9j-vw6q cover?

GHSA-7j37-5f9j-vw6q covers the following CVE IDs: CVE-2026-13129. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7j37-5f9j-vw6q?

GHSA-7j37-5f9j-vw6q has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-7j37-5f9j-vw6qHighCVSS 7.8

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field...

Vendor

GitHub Security Advisories

Published

July 8, 2026

Last Modified

July 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-13129 →

📋 Description

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13129
https://www.foxit.com/support/security-bulletins.html
https://github.com/advisories/GHSA-7j37-5f9j-vw6q