Top 10 winner

Portable Data exFiltration: XSS for PDFs

Gareth Heyes · PortSwigger Research · 10 December 2020

PDF libraries such as PDF-Lib and jsPDF do not escape parentheses in annotation URIs, so text placed into a generated PDF can close the string and inject new dictionary keys, actions and JavaScript. That gives script execution in Acrobat and Chrome's PDFium, automatic firing on open or close, theft of the document text, and blind SSRF from server-side rendering.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

10 December 2020

Topic

XSS

In the archive

• Ranked #2 in the 2020 Top 10 Web Hacking Techniques

Related sources

• All research PDF samples
• Portable Data exFiltration: XSS for PDFs
• Portable Data exFiltration XSS for PDFs - Gareth Heyes

Tags

• pdf
• injection
• ssrf
• info-leak
• xss
• javascript
• nodejs
• waf-bypass
• owasp-a03-2021
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.