Ngx-Extended-Pdf-Viewer (>= 27.0.0-Rc.0, < 29.0.0-Rc.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ngx-extended-pdf-viewer--27.0.0-rc.0--29.0.0-rc.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 06 Aug 2026 21:29:03 +0000Remote Code Execution in ngx-extended-pdf-viewer via CVE-2026-16633https://feed.craftedsignal.io/briefs/2026-08-ngx-extended-pdf-viewer-vulnerability/Thu, 06 Aug 2026 21:29:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ngx-extended-pdf-viewer-vulnerability/The ngx-extended-pdf-viewer library bundles a vulnerable version of pdf.js, allowing attackers to achieve arbitrary JavaScript execution in the context of the host application when processing malicious PDF files with XFA rich text enabled.The ngx-extended-pdf-viewer npm package contains an embedded, vulnerable version of Mozilla's pdf.js (CVE-2026-16633). Because the library bundles the engine directly instead of utilizing a standard dependency, traditional automated dependency scanners often fail to identify the vulnerable component. The vulnerability is triggered when the library processes a maliciously crafted PDF file containing XFA rich text.

The security exposure is linked to the enableXfa feature, which is enabled by default in ngx-extended-pdf-viewer. Successful exploitation allows for arbitrary JavaScript execution within the security context of the page hosting the viewer. This poses a significant risk to web applications that use this library to handle user-uploaded PDF documents. Users are advised to upgrade to version 29.0.0-rc.3 or later, which incorporates the upstream fix from pdf.js 6.2.108.

Impact

Successful exploitation leads to unauthorized JavaScript execution in the user's browser, potentially resulting in cross-site scripting (XSS), credential theft, or unauthorized actions performed on behalf of the user within the affected web application. The scope of targeting includes any web application utilizing ngx-extended-pdf-viewer versions between 27.0.0-rc.0 and 29.0.0-rc.3 that allows the processing of untrusted PDF documents.

Recommendation

  • Upgrade the ngx-extended-pdf-viewer package to version 29.0.0-rc.3 or higher immediately.
  • If an immediate upgrade is not feasible, set 'pdfDefaultOptions.enableXfa = false' to disable the vulnerable XFA feature.
  • Implement a Content Security Policy (CSP) that explicitly disallows inline scripts to mitigate the impact of potential exploitation attempts.
  • Integrate tools capable of parsing CycloneDX SBOMs provided by the package (starting with 29.0.0) to track patching status via VEX statements.
]]>highadvisorysupply-chainvulnerabilityweb-applicationjavascript