fix: Update getDocument calls to include data and isEvalSupported options

[hand-dot]

CVE-2024-4367 temporary workaround

---

The identified library pdf.js, version 3.11.174 is vulnerable.
CVE-2024-4367
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
mozilla/pdf.js@85e64b5
mozilla/pdf.js#18015
GHSA-wgrm-67xf-hhpq
https://github.com/mozilla/pdf.js
GHSA-wgrm-67xf-hhpq

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Updated (UTC)
pdfme-playground	Ignored		Sep 9, 2025 6:15am

[greptile-apps]

Greptile Summary

This PR implements a critical security fix for CVE-2024-4367 by modifying PDF.js getDocument API calls across the converter package. The changes update both browser and Node.js implementations to disable JavaScript evaluation during PDF parsing.

The core modification transforms getDocument calls from pdfjsLib.getDocument(pdf) to pdfjsLib.getDocument({ data: pdf, isEvalSupported: false }). This change is applied consistently to both pdf2img and pdf2size functions in both index.browser.ts and index.node.ts files.

The vulnerability (CVE-2024-4367) in PDF.js version 3.11.174 allowed malicious PDF files to execute JavaScript code during parsing. By explicitly setting isEvalSupported: false, this fix prevents potential arbitrary code execution while maintaining all existing PDF processing functionality. The change uses the object parameter format for getDocument calls, which is the recommended approach for security configuration in newer PDF.js versions.

This security hardening affects the converter package's core functionality for converting PDFs to images and extracting PDF dimensions, ensuring these operations are performed safely without the risk of JavaScript execution from untrusted PDF content.

Confidence score: 5/5

• This PR is extremely safe to merge as it addresses a critical security vulnerability with minimal risk
• Score reflects a straightforward security fix that disables a dangerous feature without breaking existing functionality
• No files require special attention as the changes are identical, minimal, and well-documented security hardening

_{2 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}