Portable Data ex Filtration: XSS for PDFs

Summary: PortSwigger researcher Gareth Heyes found that two npm PDF libraries, PDF-Lib (over 52k weekly downloads) and jsPDF (over 250k), escape text streams correctly but fail to escape parentheses inside annotation URIs, allowing PDF code injection. He used the flaw to inject JavaScript that, in Acrobat, submits the entire contents of a PDF to an external server in a POST request without user interaction, and also crafted an SSRF injection against a PDF rendered server-side.
What's compelling: Server-side PDF generation sits in e-tickets, receipts, boarding passes, invoices and pay slips, so user input reaching an annotation URI in either of these widely downloaded libraries can turn a document into an exfiltration channel that fires the moment another user opens it.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026