Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-17T18:16:35.650Z",
  "pubdate": "2026-08-17T18:16:35.650Z",
  "executiveSummary": "Stirling-PDF prior to version 2.0.0 contains a stored cross-site scripting vulnerability within the Get Info workflow. The application insecurely handles PDF metadata by inserting untrusted PDF Title and Author strings directly into the DOM using innerHTML. This flaw allows an authenticated or unauthenticated attacker capable of supplying a crafted PDF document to execute arbitrary JavaScript within the context of a victim's browser session. When a user initiates the Get Info action on the malicious file, the embedded payload executes automatically. The resulting impact includes potential compromise of browser-session data, unauthorized access to sensitive application state, and malicious modification of page content. Exploitation relies on user interaction, specifically requiring the victim to process the malicious PDF and invoke the vulnerable inspection workflow. Mitigation requires upgrading Stirling-PDF to version 2.0.0 or later, where proper DOM sanitization or safe text assignment methods are implemented to neutralize script injection vectors.",
  "technicalDetails": "The vulnerability resides in the Get Info workflow implemented within the template file app/core/src/main/resources/templates/security/get-info-on-pdf.html of Stirling-PDF prior to version 2.0.0. The root cause of the issue is the insecure DOM-based rendering of untrusted data derived from PDF file metadata, specifically the Title and Author fields. Rather than utilizing safe text assignment properties or applying robust HTML sanitization routines, the application passes these raw metadata strings directly into the summary-text element via the innerHTML property. An attacker exploits this behavior by embedding malicious JavaScript payloads, enclosed within HTML script tags or event handlers, into the metadata fields of a PDF file. The attack flow proceeds as follows: First, the attacker crafts a malicious PDF containing script injection payloads within its Title or Author metadata attributes. Second, the attacker induces a victim to upload and process this document within the Stirling-PDF application. Third, the victim navigates to the Get Info workflow and triggers the inspection action on the uploaded file. Fourth, the application extracts the malicious metadata and insecurely renders it into the DOM using innerHTML. Fifth, the browser parses and executes the injected JavaScript code in the context of the user's session. Post-exploitation impact encompasses the execution of arbitrary scripts, potential theft of session cookies or tokens, exfiltration of sensitive data accessible via the Document Object Model, and arbitrary defacement or manipulation of the application interface. Network exposure includes any deployment where users can process externally sourced PDF documents. Authentication and privilege requirements depend on the specific deployment configuration of the Stirling-PDF instance, but the attack fundamentally requires the victim to interact with the crafted file through the vulnerable interface."
}