CLSA-2026-1775176117 TuxCare security update for jspdf (2 CVEs)

TuxCare rebuilt jspdf to address 2 CVEs. Fixed in 3.0.4-tuxcare.7...

CLSA-2026-1773447390 TuxCare security update for jspdf (1 CVE)

TuxCare rebuilt jspdf to address 1 CVE. Fixed in 3.0.4-tuxcare.2...

CLSA-2026-1773620212 TuxCare security update for jspdf (4 CVEs)

TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 2.5.2-tuxcare.6...

CLSA-2026-1773620207 TuxCare security update for jspdf (3 CVEs)

TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 3.0.4-tuxcare.6...

CVE-2026-31898

A flaw was found in jsPDF, a JavaScript library used for generating PDF documents. This vulnerability allows a remote attacker to inject arbitrary PDF objects, including JavaScript actions, into a generated PDF. This can occur if unsanitized user input is provided to the createAnnotation method's...

CVE-2026-31898 jsPDF has a PDF Object Injection via FreeText color

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

Improper Encoding or Escaping of Output

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the createAnnotation method, whose color parameter can be injected with script objects. An attacker can inject PDF objects as freetext...

The vulnerability of the `loadFile` method in the jsPDF library allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the loadFile method in the jsPDF library relates to an incorrect limitation on the path name restrictions for directories. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the addJS() function in the jsPDF library allows a hacker to execute arbitrary code.

The vulnerability of the addJS function in the jsPDF library for creating PDF files is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, provided that the user opens a specially crafted PDF file...

CVE-2026-25535 jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in...

XML Injection

jsPDF is vulnerable to XML Injection. The vulnerability is due to improper input sanitization in the addMetadata function, which allows an attacker to inject arbitrary XMP metadata into generated PDFs and compromise their integrity when the input is unsanitized...

CVE-2026-24737 jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage and html methods when processing BMP image data with unvalidated dimensions. An attacker can cause excessive memory allocation and application unavailability by...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the addJS function due to the use of a shared module-scoped variable for storing JavaScript content. An attacker can cause sensitive data intended for one user to be included in another user's PDF by making concurrent...

PT-2026-1687

A critical Arbitrary File Read vulnerability CVE-2023-50024 has been discovered in the jsPDF library, a popular JavaScript library for client-side PDF generation. Adobe CyberSecNews CyberSecurityAwareness DataSecurity Spyware...

The vulnerability of the `addImage` method in the library for creating PDF files (jsPDF) allows a hacker to trigger a service failure.

The vulnerability of the addImage method in the library used for creating PDF files from jsPDF is related to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2025-57810

An excessive resource consumption flaw has been discovered in the jsPDF npm library. Passing a maliciously crafted PNG file to the library may result in high CPU usage and a denial of service of the program the library is being used in. Mitigation Mitigation for this issue is either not available...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage or html methods. An attacker can cause excessive CPU utilization and application unresponsiveness by supplying malicious PNG image data or URLs. Details Denial of...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.bowergithub.parallax:jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage or html methods. An attacker can cause excessive CPU utilization and application...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage or html methods. An attacker can cause excessive CPU utilization and application unresponsiveness by supplying malicious PNG image data or URLs. Details Denial of...