What is GHSA-hq66-cqwq-w95j?

GHSA-hq66-cqwq-w95j is a security advisory published by GitHub Security Advisories with High severity. PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Which CVE IDs does GHSA-hq66-cqwq-w95j cover?

GHSA-hq66-cqwq-w95j covers the following CVE IDs: CVE-2026-16633. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hq66-cqwq-w95j?

GHSA-hq66-cqwq-w95j affects 1 product, including: npm/pdfjs-dist:\u003e= 5.6.83, \u003c 6.2.108.

GHSA-hq66-cqwq-w95jHigh

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Vendor

GitHub Security Advisories

Published

August 6, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-16633 →

📋 Description

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

🎯 Affected products1

npm/pdfjs-dist:>= 5.6.83, < 6.2.108

🔗 References (3)

https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j
https://bugzilla.mozilla.org/show_bug.cgi?id=2055885
https://github.com/advisories/GHSA-hq66-cqwq-w95j