jsPDF has PDF Object Injection via Unsanitized Input in addJS Method (parallax jsPDF)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.95 % · percentile 61 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
Weaknesses (CWE)
References
- https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp
- https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437
- https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md
- https://github.com/parallax/jsPDF/releases/tag/v4.2.0
- https://access.redhat.com/security/cve/CVE-2026-25755
- https://bugzilla.redhat.com/show_bug.cgi?id=2440993
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25755.json
- https://access.redhat.com/errata/RHSA-2026:7110
- https://access.redhat.com/errata/RHSA-2026:7128
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | GitHub_M |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Advisories
- GHSA-9vjf-qc39-jprp — jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
European references
- ENISA EUVD · EUVD-2026-8109
- GCVE · GCVE-0-2026-25755
CERT-FR advisories
- CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0834 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*< 4.2.0
Affected products
| Product | Versions |
|---|---|
| parallax · jsPDF | affected < 4.2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |