CVE-2026-25940

CVE-2026-25940 affects jsPDF prior to 4.2.0 via the AcroForm module. Attackers could abuse RadioButton.createOption and the AS property to inject arbitrary PDF objects, including JavaScript actions, executed when a user hovers a radio option. The issue is fixed in jsPDF 4.2.0; apply the update or...