{"action":"Upgrade pdfjs-dist to 6.2.108 or later.","affected":[{"fixed":"6.2.108","introduced":"5.6.83"}],"component":"pdfjs-dist","cve_ids":["CVE-2026-16633"],"ecosystem":"npm","exploited":false,"fixed_versions":["6.2.108"],"ghsa_id":"GHSA-hq66-cqwq-w95j","id":"tcs_01M5KFVSS625FWHJMH9E2PPDMX","modified_at":"2026-09-10T03:50:53.721358409Z","published_at":"2026-08-06T21:12:27Z","references":["https://osv.dev/vulnerability/GHSA-hq66-cqwq-w95j","https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j","https://bugzilla.mozilla.org/show_bug.cgi?id=2055885","https://github.com/mozilla/pdf.js"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-hq66-cqwq-w95j","url":"https://osv.dev/vulnerability/GHSA-hq66-cqwq-w95j"}],"summary":"PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF"}