ngx-extended-pdf-viewer bundles a fork of pdf.js that contains a vulnerability identified as CVE-2026-16633. This vulnerability enables execution of attacker-controlled JavaScript in the context of the hosting page when a malicious PDF is opened. The issue involves two parts: one related to sandboxing requiring enableScripting (disabled by default in ngx-extended-pdf-viewer), and another related to XFA rich text processing, which is enabled by default and can be exploited. The vulnerability is addressed in version 29.0.0-rc.3 by cherry-picking Mozilla's fix from pdf.js 6.2.108. The package now includes SBOM and VEX files to verify the fix. Workarounds include disabling XFA forms and enforcing a strict Content Security Policy.

An attacker can execute arbitrary JavaScript within the context of the hosting page by tricking a user into opening a crafted malicious PDF. This can lead to high-impact client-side attacks such as cross-site scripting or data theft. The default configuration of ngx-extended-pdf-viewer reduces exposure by disabling scripting, but enabling XFA forms (default enabled) still exposes users to risk. There are no known exploits in the wild at this time.

A patch is available starting with ngx-extended-pdf-viewer version 29.0.0-rc.3, which includes the upstream fix from pdf.js 6.2.108. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, mitigate risk by setting pdfDefaultOptions.enableXfa to false if XFA forms are not required, and/or enforce a Content Security Policy that disallows inline scripts. The package provides SBOM and VEX files from version 29.0.0 to verify the applied fix.