parallax jsPDF
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-31938 | < 4.2.1 | jsPDF has HTML Injection in New Window paths | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-31898 | < 4.2.1 | jsPDF has a PDF Object Injection via FreeText color | HIGH 8.1 | 0.4 % | ||
| CVE-2026-25940 | < 4.2.0 | jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-25755 | < 4.2.0 | jsPDF has PDF Object Injection via Unsanitized Input in addJS Method | HIGH 8.8 | 1.0 % | ||
| CVE-2026-25535 | < 4.2.0 | jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions | HIGH 8.7 | 0.8 % | ||
| CVE-2026-24040 | < 4.1.0 | jsPDF has a Shared State Race Condition in addJS Plugin | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-24043 | < 4.1.0 | jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation) | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-24133 | < 4.1.0 | jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder | HIGH 8.7 | 0.6 % | ||
| CVE-2026-24737 | < 4.1.0 | jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution | HIGH 8.3 | 0.6 % | ||
| CVE-2025-68428 | < 4.0.0 | jsPDF has Local File Inclusion/Path Traversal vulnerability | CRITICAL 9.2 | 2.2 % | ||
| CVE-2025-57810 | < 3.0.2 | jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-29907 | < 3.0.1 | jsPDF Bypass Regular Expression Denial of Service (ReDoS) | HIGH 8.7 | 0.7 % |