### ImpactIf pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.### PatchesThe patch removes the use of `eval`:https://github.com/mozilla/pdf.js/pull/18015### WorkaroundsSet the option `isEvalSupported` to `false`. ### Referenceshttps://bugzilla.mozilla.org/show_bug.cgi?id=1893645