Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 Exploit, Vendor Advisory
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · stirlingNVD modified 2026-10-24 21:10
Affected (CPE criteria) 1
cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*
References 3
- https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.0.0 Product, Release Notes
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 Exploit, Vendor Advisory
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 Exploit, Vendor Advisory