{"answers":{"affected":"2 open source packages ship an affected version, including ngx-extended-pdf-viewer.","exploited":"There is no known exploitation of GHSA-w9hm-4m3m-fxmm in the wild and no public exploit code.","fix":"Upgrade ngx-extended-pdf-viewer to 29.0.0-rc.3 or later.","what":"GHSA-w9hm-4m3m-fxmm is a code injection vulnerability in ngx-extended-pdf-viewer, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-w9hm-4m3m-fxmm and fix it if it is affected.\n\nWhat it is: GHSA-w9hm-4m3m-fxmm is a code injection vulnerability in ngx-extended-pdf-viewer, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-w9hm-4m3m-fxmm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ngx-extended-pdf-viewer (npm): affected from 27.0.0-rc.0; fixed in 29.0.0-rc.3\n- ngx-extended-pdf-viewer (npm): affected from 27.0.0-rc.0; fixed in 29.0.0-rc.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-w9hm-4m3m-fxmm/ (Markdown: https://insights.sbomify.com/GHSA-w9hm-4m3m-fxmm/index.md)","id":"GHSA-w9hm-4m3m-fxmm","markdown":"https://insights.sbomify.com/GHSA-w9hm-4m3m-fxmm/index.md","name":"GHSA-w9hm-4m3m-fxmm","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Angular PDF viewer library","requires_auth":"none","summary":"Opening a malicious PDF allows attacker-controlled JavaScript execution in the hosting page context due to bundled pdf.js vulnerability.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.\n\n### Impact\nOpening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633.\n\n### Exposure. \nThe sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not — so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe.\n\n### Patches\n29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates.\n\n### Workarounds\nSet pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src.\n\n### Verifying. \nFrom 29.0.0 the package ships sbom.json and vex.json. The SBOM records the applied fix as a CycloneDX pedigree.patches entry; the VEX carries a resolved_with_pedigree statement so scanners stop flagging the engine's nominal version.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633","id":"GHSA-w9hm-4m3m-fxmm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["29.0.0-rc.3"],"introduced":["27.0.0-rc.0"],"last_affected":[],"package":"ngx-extended-pdf-viewer","purl":null,"source":"GHSA-w9hm-4m3m-fxmm"},{"ecosystem":"npm","fixed":["29.0.0-rc.3"],"introduced":["27.0.0-rc.0"],"last_affected":[],"package":"ngx-extended-pdf-viewer","purl":"pkg:npm/ngx-extended-pdf-viewer","source":"GHSA-w9hm-4m3m-fxmm"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Opening a malicious PDF allows attacker-controlled JavaScript execution in the hosting page context due to bundled pdf.js vulnerability.","url":"https://insights.sbomify.com/GHSA-w9hm-4m3m-fxmm/"}