GHSA-PQXR-3G65-P328 jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

🗓️ 02 Feb 2026 18:29:49Reported by GoogleType

osv🔗 osv.dev👁 9 Views

PDF injection in AcroForm fields allows arbitrary JavaScript via unsanitized input; fixed in jsPDF 4.1.0.

Reporter	Title	Published	Views	Family All 24
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in jsPDF (CVE-2026-24040, CVE-2026-24043, CVE-2026-24133, CVE-2026-24737)	22 May 202612:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	22 Jun 202614:32	–	ibm
ATTACKERKB	CVE-2026-24737	2 Feb 202620:29	–	attackerkb
BDU FSTEC	The vulnerability of the Acroform application programming interface module for creating PDF files, jsPDF, allows a perpetrator to execute arbitrary JavaScript code.	4 Feb 202600:00	–	bdu_fstec
Chainguard	CVE-2026-24737 vulnerabilities	11 Feb 202607:17	–	cgr
Circl	CVE-2026-24737	2 Feb 202623:19	–	circl
CNNVD	jsPDF 安全漏洞	2 Feb 202600:00	–	cnnvd
CVE	CVE-2026-24737	2 Feb 202620:29	–	cve
Cvelist	CVE-2026-24737 jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution	2 Feb 202620:29	–	cvelist
Github Security Blog	jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution	2 Feb 202618:29	–	github

Source	Link
github	www.github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24737
github	www.github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
github	www.github.com/parallax/jsPDF
github	www.github.com/parallax/jsPDF/releases/tag/v4.1.0

11 Feb 2026 02:28Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.1

EPSS0.00532