Stirling‑PDF’s Get Info workflow writes user‑controlled PDF Title and Author fields directly into a page element using innerHTML. A malicious PDF containing crafted metadata can trigger an arbitrary script on the user’s browser when they click Get Info, allowing the attacker to read or manipulate session data or modify the page content.

Stirling‑Tools’ Stirling‑PDF application is affected in every release prior to version 2.0.0. Deployments running an earlier version are vulnerable; the issue was addressed in v2.0.0.

Based on the description, the vulnerability is rated high with a CVSS score of 8.1. Although EPSS is not available and it is not listed in CISA’s KEV, the local‑host nature of the application makes it accessible to an attacker who can supply a malicious PDF via local or shared storage. Once the user opens the PDF and uses the Get Info feature, the stored XSS payload executes in the user’s browser, potentially hijacking the session or injecting arbitrary content. The attack requires the victim to visit the application and view the malicious PDF; based on the description it is inferred that the malicious PDF could be delivered via shared files or phishing links on the host.