(Snyk Security Code Tool) Arbitrary Code Injection affecting package pdfjs-dist about ng2-pdf-viewer

[antonio-santos-zact]

I also found that same vulnerability when running npm audit

pdfjs-dist <=4.1.392
Severity: high
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - [GHSA-wgrm-67xf-hhpq](https://github.com/advisories/GHSA-wgrm-67xf-hhpq)
No fix available
node_modules/pdfjs-dist
ng2-pdf-viewer *
Depends on vulnerable versions of pdfjs-dist
node_modules/ng2-pdf-viewer

[arielpetri]

Hello! Any solution to this?

[RobJacobs]

To get around this, I added the following to my package.json:

  "overrides": {
    "ng2-pdf-viewer": {
      "pdfjs-dist": "^4.3.136"
    }
  }

then in the consuming component I had to override the pdfWorkerSrc variable:

constructor() {
  (window as any).pdfWorkerSrc = 'https://cdn.jsdelivr.net/npm/[email protected]/legacy/build/pdf.worker.min.mjs';
}

[arielpetri]

Thank you! But it doesn't compile when I do that.
It gives me the following error:
Error: node_modules/ng2-pdf-viewer/src/app/pdf-viewer/pdf-viewer.component.d.ts:7:37 - error TS2307: Cannot find module 'pdfjs-dist/web/pdf_viewer' or its corresponding type declarations.

I have the version:
"ng2-pdf-viewer": "^10.2.2",

and
"overrides": {
"ng2-pdf-viewer": {
"pdfjs-dist": "^4.3.136"
}
}

Any suggestions or something I'm missing?

Thanks again!

[shamoon]

I suggest folks here read the release notes and relevant PRs, the security issue was closed but the pdfjs package itself wasn’t updated all the way so automated alerts like this won’t go away (perhaps they can be dismissed another way, I don’t know). This project is not currently compatible with pdfjs 4.x to my knowledge so the security issue was closed by another valid published means