CVE-2026-33437 Stirling-Tools CVE debrief

Who should care

Defenders responsible for Stirling-PDF deployments should assess exposure and prioritize remediation to prevent exploitation of this vulnerability. This includes reviewing the current version of Stirling-PDF, assessing the potential impact of the vulnerability, and implementing necessary mitigations to protect against potential attacks.

Why it matters

Defenders should prioritize remediation of CVE-2026-33437 in Stirling-PDF deployments to prevent exploitation of this stored XSS vulnerability, which could allow access to browser-session data or modification of page content by malicious PDFs.

• Access to browser-session data
• Modification of page content by malicious PDFs
• Potential for phishing or further exploitation
• Verification of user interaction with malicious PDFs

Technical summary

The Get Info workflow in Stirling-PDF inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This vulnerability is due to improper handling of user-input data and highlights the importance of sanitizing metadata to prevent such attacks. Defenders should prioritize upgrading to version 2.0.0 or applying compensating controls to prevent exploitation.

Defensive priority

Defenders should prioritize upgrading to version 2.0.0 or applying compensating controls to prevent exploitation of this vulnerability in Stirling-PDF.

Recommended defensive actions

• Upgrade to version 2.0.0 or later
• Implement compensating controls to prevent exploitation
• Monitor for suspicious activity in Stirling-PDF
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score of 8.1. However, the record of affected versions and remediation is limited. Defenders should verify the accuracy of the provided information and review the official advisory for further details on the vulnerability and recommended mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.