Stirling-PDF versions before 2.0.0 contain a CWE-79 XSS vulnerability in the /get-info-on-pdf endpoint. The vulnerability arises because the application renders PDF metadata fields (Title and Author) directly into the web page without proper HTML encoding or sanitization. An attacker can exploit this by embedding malicious JavaScript in these metadata fields within a crafted PDF file. When a user accesses the endpoint to view PDF information, the malicious script executes in their browser context. This vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity. The vulnerability is resolved in Stirling-PDF version 2.0.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the user's browser when viewing the /get-info-on-pdf page for a crafted PDF. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of the page content. There is no direct impact on availability. The vulnerability requires user interaction (viewing the page) and is remotely exploitable without privileges.

A fix is available in Stirling-PDF version 2.0.0. Users should upgrade to version 2.0.0 or later to remediate this vulnerability. No official vendor advisory or patch link is provided, but the version 2.0.0 release is stated to fix the issue. Until upgraded, users should avoid processing untrusted PDF files with the affected endpoint.