Re:We pwned X, Vercel, Cursor, and Discord through a supply-...
by jonahx on Thursday December 18, 2025 @04:24PM
(#46318995)
Does that mean that opening arbitrary pdfs on your laptop is unsafe?
[ Parent
| on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-...
by Sohcahtoa82 on Thursday December 18, 2025 @05:15PM
(#46319573)
Let me put it this way...
In one of my penetration testing training classes, in one of the lessons, we generated a malicious PDF file that would give us a shell when the victim opened it in Adobe.
Granted, it relied on a specific bug in the JavaScript engine of Adobe Reader, so unless they're using a version that's 15 years old, it wouldn't work today, but you can't be too cautious. 0-days can always exist.
Re:We pwned X, Vercel, Cursor, and Discord through a supply-...
by bmacho on Thursday December 18, 2025 @04:28PM
(#46319043)
Yes, opening random pdfs especially in random and old pdf viewers is not a good idea.
If you must open a possibly infected pdf, then do it in browser, pdf.js is considered mostly safe, and updated.
Re:We pwned X, Vercel, Cursor, and Discord through a supply-...
by rvnx on Thursday December 18, 2025 @07:57PM
(#46321015)
Use the PDF to JPG online services, convenient and you still get your result without having to deal with any sandbox
Re:We pwned X, Vercel, Cursor, and Discord through a supply-...
by bpt3 on Thursday December 18, 2025 @08:38PM
(#46321324)
Except of course that you're sharing the contents of that PDF with a random online service.