(Snyk Security Code Tool) Arbitrary Code Injection affecting package pdfjs-dist

[Panagiotis-Vasiloglou]

Bug Report or Feature Request (mark with an x)

- [ ] Regression (a behavior that used to work and stopped working in a new release)
- [X] Bug report -> please search issues before submitting
- [ ] Feature request
- [ ] Documentation issue or request

Don't know if is "Bug report", but a few days ago, a kind of a popular tool called "Snyk Security" (also a VScode extension), occured an error about ng2-pdf-viewer library.

When I hovered, it displayed this message "Arbitrary Code Injection affecting package pdfjs-dist". I checked the generated report and suggested to 'Upgrade pdfjs-dist to version 4.2.67 or higher.'

This is the URL of the full report
https://security.snyk.io/vuln/SNYK-JS-PDFJSDIST-6810403

[antonio-santos-zact]

I also found that same vulnerability when running npm audit

pdfjs-dist <=4.1.392
Severity: high
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - [GHSA-wgrm-67xf-hhpq](https://github.com/advisories/GHSA-wgrm-67xf-hhpq)
No fix available
node_modules/pdfjs-dist
ng2-pdf-viewer *
Depends on vulnerable versions of pdfjs-dist
node_modules/ng2-pdf-viewer

[arielpetri]

Hello! Any solution to this?

[RobJacobs]

To get around this, I added the following to my package.json:

  "overrides": {
    "ng2-pdf-viewer": {
      "pdfjs-dist": "^4.3.136"
    }
  }

then in the consuming component I had to override the pdfWorkerSrc variable:

constructor() {
  (window as any).pdfWorkerSrc = 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.3.136/legacy/build/pdf.worker.min.mjs';
}

[arielpetri]

Thank you! But it doesn't compile when I do that.
It gives me the following error:
Error: node_modules/ng2-pdf-viewer/src/app/pdf-viewer/pdf-viewer.component.d.ts:7:37 - error TS2307: Cannot find module 'pdfjs-dist/web/pdf_viewer' or its corresponding type declarations.

I have the version:
"ng2-pdf-viewer": "^10.2.2",

and
"overrides": {
"ng2-pdf-viewer": {
"pdfjs-dist": "^4.3.136"
}
}

Any suggestions or something I'm missing?

Thanks again!

[shamoon]

I suggest folks here read the release notes and relevant PRs, the security issue was closed but the pdfjs package itself wasn’t updated all the way so automated alerts like this won’t go away (perhaps they can be dismissed another way, I don’t know). This project is not currently compatible with pdfjs 4.x to my knowledge so the security issue was closed by another valid published means