Loading vulnerability…
Stored DOM XSS in Apryse WebViewer via PDF annotation Author (/T) field
CVE-2025-70401 is a high-severity stored DOM-based XSS in Apryse WebViewer (formerly PDFTron) triggered via a crafted PDF annotation author field (/T). The attacker embeds script payloads in the annotation “Author” name; when the PDF is opened in WebViewer and the victim interacts with the notes UI (reported as “when a victim types a character in notes”), the author string is processed through React’s internal he() helper and then assigned to innerHTML without proper encoding/sanitization, resulting in script execution in the WebViewer origin.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in JavaScript execution in the context of the Apryse WebViewer application, enabling theft of user secrets (explicitly reported: login data theft) and potentially account takeover depending on session/token handling and application permissions.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by restricting untrusted PDFs/annotations from being opened in WebViewer contexts that carry authenticated sessions; enforce a strict CSP to limit script execution impact; and ensure any UI rendering of annotation metadata uses safe React rendering (no dangerouslySetInnerHTML/innerHTML for untrusted fields) or sanitizes with a proven HTML sanitizer configured to disallow script-capable constructs.
Patch, then assume compromise.
Apply the vendor-provided Apryse WebViewer patch/updated version that corrects unsafe rendering of the annotation author field (eliminating innerHTML assignment of untrusted data and/or adding robust output encoding/sanitization).
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.