A vulnerability in pdfjs-dist allows arbitrary JavaScript execution when opening a malicious PDF if scripting is enabled (enableScripting=true) and no Content Security Policy (CSP) restricts script sources. This can lead to attacker-controlled script running in the context of the hosting domain. The issue affects versions from 5.6.83 up to but not including 6.2.108. A patch is available, and mitigation includes disabling scripting or applying a CSP.