CVE-2024-4367

### Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

‍
### Patches
The patch removes the use of `eval`:
https://github.com/mozilla/pdf.js/pull/18015

### Workarounds
Set the option `isEvalSupported` to `false`.

### References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645