CVE-2026-33437 in Stirling-PDF
Summary
by MITRE • 08/17/2026
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Stirling-PDF prior to version 2.0.0 represents a classic instance of stored cross-site scripting, technically classified under CWE-79: Improper Neutralization of Input During Web Page Generation. This flaw resides within the application's Get Info workflow, specifically located in the template file app/core/src/main/resources/templates/security/get-info-on-pdf.html. The core technical deficiency involves the improper handling of untrusted data derived from PDF metadata fields, namely the Title and Author attributes. When a user interacts with the interface to retrieve information about an uploaded document, the application extracts these specific metadata values and injects them directly into the DOM using the innerHTML property without adequate sanitization or encoding. This method of insertion bypasses standard browser security mechanisms that might otherwise neutralize script tags or event handlers embedded within the input data.
The operational impact of this vulnerability is significant because it allows for persistent code execution rather than transient reflection. Since the malicious metadata is stored as part of the PDF file itself, any user who subsequently opens a document containing the crafted payload will trigger the execution context upon clicking the Get Info button. An attacker can craft a PDF with JavaScript payloads embedded in its Title or Author fields. When an unsuspecting victim views this document's properties through the vulnerable interface, the browser interprets the injected content as executable script rather than plain text. This leads to the compromise of the user's session integrity and potentially allows for full control over the local web application environment from within the context of the trusted domain hosting Stirling-PDF.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript execution in browser environments. The ability to execute arbitrary scripts enables attackers to perform session hijacking by stealing cookies or local storage data that contain authentication tokens or sensitive user information. Furthermore, the attacker can modify page content dynamically, potentially creating phishing interfaces within the application itself or redirecting users to malicious external sites. This compromises not only the confidentiality and integrity of individual user sessions but also undermines trust in the overall security posture of locally hosted PDF processing tools used by organizations for document management.
The remediation strategy implemented in version 2.0.0 addresses this issue by enforcing strict input validation and output encoding practices. Developers must ensure that all data originating from external sources, such as file metadata, is treated as untrusted until explicitly validated against a whitelist of allowed characters or properly encoded before being inserted into the DOM. Replacing innerHTML with safer alternatives like textContent prevents the browser from interpreting injected strings as executable code. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute. Regular security audits focusing on template injection vulnerabilities are recommended for all web applications that process user-uploaded files with metadata fields displayed in dynamic UI elements.