CVE-2026-16633

High

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
pdfjs-distnpm	5.6.205, 5.7.284	6.2.108	2

2 by stars

Chart

Latest

Affected images

Radar Score

openclawopenclaw-helm

1 of the 2 container images this version deploys carry CVE-2026-16633.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	pdfjs-dist@5.7.284	6.2.108

5,660

stocksalescluster-deploy

1 of the 1 container images this version deploys carry CVE-2026-16633.

Container image	Digest	Package	Fixed in
foggbh/stocky :latest	8b7a2e5ecf4e	pdfjs-dist@5.6.205	6.2.108

408

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
foggbh/stocky :latest	8b7a2e5ecf4e	pdfjs-dist@5.6.205	6.2.108	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	pdfjs-dist@5.7.284	6.2.108	1