html2pdf.js contains a cross-site scripting vulnerability

Impact html2pdf.js contains a cross-site scripting XSS vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, an...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7365admin1/layer-common (>=1.10.7, <=4.85.0) +266 more potentially affected by CVE-2026-22787 via html2pdf.js (>=0.9.3, <=0.13.0)

html2pdf.js NPM version =0.9.3, =1.0.0, =1.10.7, =1.0.12-beta.20, =1.0.1, =1.0.12-beta.1, =0.1.11, =1.0.7, =1.4.4, =1.13.2-dev.0, =1.29.0-rc.0, =1.3.1, =0.4.80, =0.3.9, =0.7.13 and more Source cves: CVE-2026-22787 Source advisory: OSV:GHSA-W8X4-X68C-M6FC...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7365admin1/layer-common (>=1.10.7, <=4.85.0) +266 more potentially affected by CVE-2026-22787 via html2pdf.js (>=0.9.3, <=0.13.0)

html2pdf.js NPM version =0.9.3, =1.0.0, =1.10.7, =1.0.12-beta.20, =1.0.1, =1.0.12-beta.1, =0.1.11, =1.0.7, =1.4.4, =1.13.2-dev.0, =1.29.0-rc.0, =1.3.1, =0.4.80, =0.3.9, =0.7.13 and more Source cves: CVE-2026-22787 Source advisory: SNYK:JS-HTML2PDFJS-14943969...

CVE-2026-22787 html2pdf.js has a cross-site scripting vulnerability

html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting XSS vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing...