Yeah, and that feature was only used in the Firefox deployment of pdf.js.

https://github.com/mozilla/pdf.js/commit/4f3f983a214867011dd...

Not sure who's to blame, but like he said, there was no vulnerability in the web version.