ngx-extended-pdf-viewer includes a forked version of Mozilla's pdf.js that is vulnerable to CVE-2026-16633. This vulnerability allows execution of attacker-controlled JavaScript when opening a malicious PDF, potentially impacting the hosting page. The default configuration reduces exposure compared to upstream pdf.js, but enabling XFA forms (enabled by default) still presents risk. A patch is available from version 29.0.0-rc.3, which backports the upstream fix. Workarounds include disabling XFA forms or applying a Content Security Policy to block inline scripts.