Lucene search

Jspdf Security Vulnerabilities - November

cve

CVE-2020-7690

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

6.1CVSS

6.1AI Score

0.001EPSS

2020-07-06 01:15 PM

cve

CVE-2020-7691

In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

6.3CVSS

6.2AI Score

0.003EPSS

2020-07-06 01:15 PM

cve

CVE-2021-23353

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

7.5CVSS

7.5AI Score

0.005EPSS

2021-03-09 07:15 PM