Remote Code Execution in ngx-extended-pdf-viewer via CVE-2026-16633

The ngx-extended-pdf-viewer npm package contains an embedded, vulnerable version of Mozilla's pdf.js (CVE-2026-16633). Because the library bundles the engine directly instead of utilizing a standard dependency, traditional automated dependency scanners often fail to identify the vulnerable component. The vulnerability is triggered when the library processes a maliciously crafted PDF file containing XFA rich text.

The security exposure is linked to the enableXfa feature, which is enabled by default in ngx-extended-pdf-viewer. Successful exploitation allows for arbitrary JavaScript execution within the security context of the page hosting the viewer. This poses a significant risk to web applications that use this library to handle user-uploaded PDF documents. Users are advised to upgrade to version 29.0.0-rc.3 or later, which incorporates the upstream fix from pdf.js 6.2.108.

Impact

Successful exploitation leads to unauthorized JavaScript execution in the user's browser, potentially resulting in cross-site scripting (XSS), credential theft, or unauthorized actions performed on behalf of the user within the affected web application. The scope of targeting includes any web application utilizing ngx-extended-pdf-viewer versions between 27.0.0-rc.0 and 29.0.0-rc.3 that allows the processing of untrusted PDF documents.

Recommendation

• Upgrade the ngx-extended-pdf-viewer package to version 29.0.0-rc.3 or higher immediately.
• If an immediate upgrade is not feasible, set 'pdfDefaultOptions.enableXfa = false' to disable the vulnerable XFA feature.
• Implement a Content Security Policy (CSP) that explicitly disallows inline scripts to mitigate the impact of potential exploitation attempts.
• Integrate tools capable of parsing CycloneDX SBOMs provided by the package (starting with 29.0.0) to track patching status via VEX statements.