CVE-2024-34342
1 advisory.
npm/react-pdf CVE-2024-34342: high 7.1
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
Action: Upgrade react-pdf to 7.7.3 or later.
npm i react-pdf@7.7.3npm i react-pdf@8.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.7.3 | - |
| 8.0.0 | 8.0.2 | - |
Fixed versions
| 7.7.3 | 8.0.2 |
Sources
- osv: GHSA-87hq-q4gp-9wr4
- https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
- https://github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4
- https://nvd.nist.gov/vuln/detail/CVE-2024-34342
- https://github.com/mozilla/pdf.js/pull/18015
- https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
- https://github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe
- https://github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad
- https://github.com/wojtekmaj/react-pdf
CVE-2024-34342 · published · modified · JSON