CVE-2026-31898: Improper Encoding or Escaping of Output

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

The vulnerability of the output() function in the jsPDF PDF-generation library allows a hacker to execute arbitrary code.

The vulnerability of the output function in the jsPDF PDF-generation library relates to the lack of protection for the web page structure during the processing of the options parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, provided that the user opens ...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31938 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31938 Source advisory: SNYK:JS-JSPDF-15678195...

Cross-site Scripting (XSS)

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Cross-site Scripting XSS in jspdf.js, when user-controlled values are passed to the options argument, then included unsanitized in the generated HTML and opened by another user. An attack...

GHSA-WFV2-PWC8-CRG5 jsPDF has HTML Injection in New Window paths

Impact User control of the options argument of the output function allows attackers to inject arbitrary HTML such as scripts into the browser context the created PDF is opened in. The affected overloads and options are: "pdfobjectnewwindow": the pdfObjectUrl option and the entire options object,...

org.webjars.npm:dom-to-pdf (0.3.2), org.webjars.npm:html2pdf.js (>=0.10.1, <=0.10.3) potentially affected by CVE-2026-31938 via org.webjars.npm:jspdf (>=2.5.2, <=3.0.3)

org.webjars.npm:jspdf MAVEN version =2.5.2, =0.10.1, =0.10.3 Source cves: CVE-2026-31938 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15678196...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31938 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31938 Source advisory: OSV:GHSA-WFV2-PWC8-CRG5...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the createAnnotation method, whose color parameter can be injected with script objects. An attacker can inject PDF objects as freetext annotations, which may be executed when a user opens the...

Improper Encoding or Escaping of Output

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the createAnnotation method, whose color parameter can be injected with script objects. An attacker can inject PDF objects as freetext...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31898 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31898 Source advisory: OSV:GHSA-7X6V-J9X4-QF24...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31898 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31898 Source advisory: SNYK:JS-JSPDF-15677842...

org.webjars.npm:dom-to-pdf (0.3.2), org.webjars.npm:html2pdf.js (>=0.10.1, <=0.10.3) potentially affected by CVE-2026-31898 via org.webjars.npm:jspdf (>=2.5.2, <=3.0.3)

org.webjars.npm:jspdf MAVEN version =2.5.2, =0.10.1, =0.10.3 Source cves: CVE-2026-31898 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15677843...

PT-2026-25976

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1 Description jsPDF is a JavaScript library used to generate PDF documents. A flaw exists where user-controlled arguments within the createAnnotation method can allow the injection of arbitrary PDF objects, includin...

PT-2026-25977

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1 Description jsPDF, a JavaScript library used for generating PDFs, contains a flaw where insufficient sanitization of user-controlled input within the options argument of the output function allows attackers to...

The vulnerability of the `loadFile` method in the jsPDF library allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the loadFile method in the jsPDF library relates to an incorrect limitation on the path name restrictions for directories. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the addJS() function in the jsPDF library allows a hacker to execute arbitrary code.

The vulnerability of the addJS function in the jsPDF library for creating PDF files is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, provided that the user opens a specially crafted PDF file...

📄 jsPDF PDF Object Injection

jsPDF versions prior to 4.2.0 suffer from a PDF object injection vulnerability the addJS method. CVE-2026-25755: PDF Object Injection in jsPDF addJS Method Description A PDF Object Injection vulnerability was identified in the addJS method of jsPDF. The library fails to sanitize user-supplied inp...

CVE-2026-25940

A flaw was found in jsPDF. The properties and methods of the Acroform module accept user input without sanitization, allowing an attacker to inject arbitrary PDF objects, such as JavaScript actions. Specifically, if an attacker can supply a specially crafted input to the...

Improper Encoding or Escaping of Output

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the appearanceState property of the AcroForm module. An attacker can execute arbitrary JavaScript code in the context of the PDF viewer by...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25940 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25940 Source advisory: SNYK:JS-JSPDF-15322684...