CVE-2024-34342: react-pdf Arbitrary JavaScript Execution Vulnerability
Summary
CVE-2024-34342: react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js. Affects react-pdf across 2 version ranges.
< 7.7.3
>= 8.0.0, < 8.0.2
Fixed in 7.7.3 or 8.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-pdf is an npm package that provides a React component for rendering PDF documents. It allows developers to display PDF files within their React applications. The package is widely used and provides various features for working with PDFs. However, a vulnerability has been discovered in react-pdf that allows for arbitrary JavaScript execution when opening a malicious PDF using PDF.js.
Vulnerability Detail
The vulnerability arises when PDF.js is used to load a malicious PDF, and PDF.js is configured with the default value of isEvalSupported set to true. This configuration allows unrestricted execution of attacker-controlled JavaScript code within the context of the hosting domain. This can lead to various security risks, including unauthorized access, data theft, and remote code execution. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 11.0.0 as of 23 Oct 2026
npm install react-pdf@11.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.7.37.7.3npm install react-pdf@7.7.3 -
>= 8.0.0, < 8.0.28.0.2npm install react-pdf@8.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating react-pdf is not immediately feasible, a temporary workaround is to set the options.isEvalSupported prop to false in the Document component. This can be done by modifying the code where the Document component is used and passing the isEvalSupported prop with a value of false. However, this workaround should be considered temporary, and updating to the latest version of react-pdf is still recommended.
Conclusion
The react-pdf package is vulnerable to arbitrary JavaScript execution when loading a malicious PDF using PDF.js. It is crucial to update react-pdf to version 7.7.3 or higher to mitigate this vulnerability. Alternatively, developers can apply a temporary workaround by setting the options.isEvalSupported prop to false in the Document component. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for react-pdf →
FAQ
react-pdf is an npm package that provides a React component for rendering PDF documents within React applications.
The vulnerability allows for arbitrary JavaScript execution when opening a malicious PDF using PDF.js. This can lead to unauthorized access, data theft, and remote code execution.
To fix this vulnerability, update react-pdf to version 7.7.3 or higher. Alternatively, set the options.isEvalSupported prop to false in the Document component as a temporary workaround.
Yes, the CVSS score for this vulnerability is 7.1, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-87hq-q4gp-9wr4.
