# CVE-2024-1234: PDF JavaScript Injection

## Abstract

In this paper we describe a vulnerability in which a malicious PDF
uses a /JavaScript action to execute arbitrary code. The eval() function
is called with attacker-controlled input.

## Proof of Concept

```python
# This is a PoC for the vulnerability described above.
import subprocess
# Note: this code is for educational purposes only.
payload = "eval('alert(1)')"
print(f"Payload: {payload}")
```

## Remediation

Patch the reader to ignore /JavaScript actions in /OpenAction.