CVE-2026-25940

HIGH EPSS 26.2%
Published Feb 19, 20264mo ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Feb 19, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.

CVSS Details

Base Score
8.1
Exploitability
2.8
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
26.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-116

Affected Products 1

VendorProductVersionRange
paralljspdf* <4.2.0

References 3

  • github.com https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375
    Patch
  • github.com https://github.com/parallax/jsPDF/releases/tag/v4.2.0
    Release Notes
  • github.com https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m
    Vendor Advisory

Remediation

  • github.com https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375
    Patch