pdfjs has a security vulnerability under version 3.2.146. Can it be upgraded to 4.2.67 or higher?

[ava-zhang1]

Affected versions of this package are vulnerable to Arbitrary Code Injection in font_loader.js, which passes input to the eval() function when the default isEvalSupported option is in use. An attacker can execute code by convincing a user to open a malicious PDF file.

[godehk]

We are also getting same below , could you please fix asap and we bought license too

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Evidence Vulnerable Package pdfjs-dist:3.11.174

Solution: Upgrade to version 4.2.67 or above.

[alessiofnes]

We are also getting same below , could you please fix asap and we bought license too

I agree, any updates?

[joebaileyrsm]

Agreed, We need update on this, it is obviously impacting multiple customers.

[liangskyli]

I also encountered the same problem and hope to upgrade and update

[shaangidwani]

I have same issue any timeline to update this package as we are stuck on this.

[olhapi]

You can pass this to your Viewer component to disable JS in PDF transformGetDocumentParams={(params) => ({ ...params, isEvalSupported: false })}