The fix, in one snippet
Acrobat: Preferences > JavaScript > uncheck Enable Acrobat JavaScript
Or open it in your browser's built-in viewer.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner parses the PDF's objects and looks for the /JS and /JavaScript keys, including inside compressed object streams (/ObjStm with FlateDecode) and in the hex-escaped spellings (/J#53, /Java#53cript) used to defeat naive searches. Where the script stream is plain or Flate-compressed it extracts a snippet and looks for app.launchURL, this.exportDataObject, util.printf, unescape("%u…") heap-spray strings and unusually long string literals. It also reports what triggers the script: /OpenAction, page or document /AA events, or form-field actions. Limits: an encrypted PDF hides the names until decrypted; unusual filters are not decoded; JavaScript in a PDF is not automatically malicious, because forms use it for validation and calculation.
Why it matters
Acrobat's JavaScript engine has been the entry point for a long list of exploits (the util.printf overflow CVE-2008-2992 and Collab.collectEmailInfo among the best known), and heap sprays written in PDF JavaScript were the standard exploit-kit technique for years. Today the more common use is phishing: a script that opens a URL on load, submits form data to an external server, or displays a dialog that walks the victim toward a credential page. Browser viewers (Chrome's PDFium, Firefox's pdf.js) run a limited sandboxed subset, and macOS Preview runs none, so the exposure is highest for Acrobat and Reader users with JavaScript enabled, which is the default.
How to fix it
Open untrusted PDFs in the browser or in Preview rather than Acrobat. In Acrobat: Edit > Preferences > JavaScript > untick "Enable Acrobat JavaScript", and under Security (Enhanced) enable Protected View for all files. Keep the reader updated. To confirm the finding yourself, Didier Stevens' pdfid.py counts the relevant keywords without opening the file:
$ pdfid.py statement.pdf
/JS 1
/JavaScript 1
/OpenAction 1Extract text with pdftotext in a sandbox if you only need the content. Related checks: launch and open actions and embedded files. Guides: malicious PDF files and is this file safe?
Where this fits
PDF contains JavaScript is check 12 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Office document loads a remote template (high), where the document is attached to a template at a remote address, so opening it silently fetches content from an external server. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
PDF contains JavaScript closes one route in. Immediately below it: PDF contains launch or open actions, where the PDF contains an action that fires when the file opens or when you interact with it, such as launching a program, opening a URL or submitting form data; Windows shortcut (.lnk) file, where the file is a Windows shortcut (.lnk), which can run any command line under any icon and any name, and is a favourite disguise for malware droppers; Deeply nested archive, where the archive contains further archives several levels deep, a structure used to exhaust scanners and to strip the Mark of the Web before the payload arrives.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: PDF contains JavaScript (high severity)
Scanner check id: pdf-javascriptThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 11, 2026
Malicious PDF Files: How a Document Runs Code and How to Check One
PDFs can carry JavaScript, launch actions, embedded files and exploits for the reader itself. The structures attackers use, the signals...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide