fix(deps): update dependency jspdf to v4 [security] by renovate[bot] · Pull Request #587 · bcgov/nr-nmp

renovate · 2026-01-05T19:03:09Z

This PR contains the following updates:

Package	Change	Age	Confidence
jspdf	`^3.0.4` → `^4.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

jsPDF has Local File Inclusion/Path Traversal vulnerability

CVE-2025-68428 / GHSA-f8cm-6447-x5h2

More information

Details

Impact

User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.

If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs.

Other affected methods are: addImage, html, addFont.

Only the node.js builds of the library are affected, namely the dist/jspdf.node.js and dist/jspdf.node.min.js files.

Example attack vector:

import { jsPDF } from "./dist/jspdf.node.js";

const doc = new jsPDF();

doc.addImage("./secret.txt", "JPEG", 0, 0, 10, 10);
doc.save("test.pdf"); // the generated PDF will contain the "secret.txt" file

Patches

The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes.

Workarounds

With recent node versions, jsPDF recommends using the --permission flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. See the node documentation for details.

For older node versions, sanitize user-provided paths before passing them to jsPDF.

Credits

Researcher: kilkat (Kwangwoon Kim)

Severity

CVSS Score: 9.2 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has Shared State Race Condition in addJS Plugin

CVE-2026-24040 / GHSA-cjw8-79x6-5cj4

More information

Details

Impact

The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.

If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B.

Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side.

import { jsPDF } from "jspdf";

const docA = new jsPDF();
const docB = new jsPDF();

// 1. User A sets their script (stored in shared 'text' variable)
docA.addJS('console.log("Secret A");');

// 2. User B sets their script (overwrites shared 'text' variable)
docB.addJS('console.log("Secret B");');

// 3. User A saves their PDF (reads current 'text' variable)
docA.save("userA.pdf");

// Result: userA.pdf contains "Secret B" instead of "Secret A"

Patches

The vulnerability has been fixed in jspdf@4.0.1. The fix moves the shared variable into the function scope, ensuring isolation between instances.

Workarounds

Avoid using the addJS method in concurrent server-side environments. If usage is required, ensure requests are processed sequentially (e.g., using a queue) rather than in parallel.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

CVE-2026-24043 / GHSA-vm32-vv63-w422

More information

Details

Impact

User control of the first argument of the addMetadata function allows users to inject arbitrary XML.

If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed.

Example attack vector:

import { jsPDF } from "jspdf"

const doc = new jsPDF()

// Input a string that closes the current XML tag and opens a new one.
// We are injecting a fake "dc:creator" (Author) to spoof the document source.
const maliciousInput = '</jspdf:metadata></rdf:Description>' +
    '<rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/">' +
    '<dc:creator>TRUSTED_ADMINISTRATOR</dc:creator>' + // <--- Spoofed Identity
    '</rdf:Description>' +
    '<rdf:Description><jspdf:metadata>'

// The application innocently adds the user's input to the metadata
doc.addMetadata(maliciousInput, "http://valid.namespace")

doc.save("test.pdf")

Patches

The vulnerability has been fixed in jsPDF@4.1.0

Workarounds

Sanitize user input before passing it to the addMetadata method: escape XML entities. For example:

let input = "..."

input = input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&apos;")

doc.addMetadata(input)

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

CVE-2026-24737 / GHSA-pqxr-3g65-p328

More information

Details

Impact

User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are:

AcroformChoiceField.addOption
AcroformChoiceField.setOptions
AcroFormCheckBox.appearanceState
AcroFormRadioButton.appearanceState

Example attack vector:

import { jsPDF } from "jspdf"
const doc = new jsPDF();

var choiceField = new doc.AcroFormChoiceField();
choiceField.T = "VulnerableField";
choiceField.x = 20;
choiceField.y = 20;
choiceField.width = 100;
choiceField.height = 20;

// PAYLOAD:
// 1. Starts with "/" to bypass escaping.
// 2. "dummy]" closes the array.
// 3. "/AA" injects an Additional Action (Focus event).
// 4. "/JS" executes arbitrary JavaScript.
const payload = "/dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage [";

choiceField.addOption(payload);
doc.addField(choiceField);

doc.save("test.pdf");

Patches

The vulnerability has been fixed in jsPDF@4.1.0.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Credits

Research and fix: Ahmet Artuç

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

CVE-2026-24133 / GHSA-95fx-jjr5-f39c

More information

Details

Impact

User control of the first argument of the addImage method results in Denial of Service.

If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, wich lead to excessive memory allocation.

Other affected methods are: html.

Example attack vector:

import { jsPDF } from "jspdf" 

// malicious BMP image data with large width/height headers
const payload = ...

const doc = new jsPDF();

doc.addImage(payload, "BMP", 0, 0, 100, 100);

Patches

The vulnerability has been fixed in jsPDF 4.1.0. Upgrade to jspdf@>=4.1.0.

Workarounds

Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

CVE-2026-25535 / GHSA-67pg-wm7f-q7fj

More information

Details

Impact

User control of the first argument of the addImage method results in denial of service.

If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.

Other affected methods are: html.

Example attack vector:

import { jsPDF } from "jspdf" 

// malicious GIF image data with large width/height headers
const payload = ...

const doc = new jsPDF();

doc.addImage(payload, "GIF", 0, 0, 100, 100);

Patches

The vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@>=4.2.0.

Workarounds

Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.

References

https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

CVE-2026-25755 / GHSA-9vjf-qc39-jprp

More information

Details

Impact

User control of the argument of the addJS method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.

import { jsPDF } from "jspdf";
const doc = new jsPDF();
// Payload:
// 1. ) closes the JS string.
// 2. > closes the current dictionary.
// 3. /AA ... injects an "Additional Action" that executes on focus/open.
const maliciousPayload = "console.log('test');) >> /AA << /O << /S /JavaScript /JS (app.alert('Hacked!')) >> >>";

doc.addJS(maliciousPayload);
doc.save("vulnerable.pdf");

Patches

The vulnerability has been fixed in jspdf@4.2.0.

Workarounds

Escape parentheses in user-provided JavaScript code before passing them to the addJS method.

References

https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

CVE-2026-25940 / GHSA-p5xg-68wr-hm3m

More information

Details

Impact

User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option.

AcroformChildClass.appearanceState

Example attack vector:

import { jsPDF } from "jspdf"
const doc = new jsPDF();

const group = new doc.AcroFormRadioButton();
group.x = 10; group.y = 10; group.width = 20; group.height = 10;
doc.addField(group);

const child = group.createOption("opt1");
child.x = 10; child.y = 10; child.width = 20; child.height = 10;
child.appearanceState = "Off /AA << /E << /S /JavaScript /JS (app.alert('XSS')) >> >>";

doc.save("test.pdf");

Patches

The vulnerability has been fixed in jsPDF@4.2.0.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has a PDF Object Injection via FreeText color

CVE-2026-31898 / GHSA-7x6v-j9x4-qf24

More information

Details

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

createAnnotation: color parameter

Example attack vector:

import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF has HTML Injection in New Window paths

CVE-2026-31938 / GHSA-wfv2-pwc8-crg5

More information

Details

Impact

User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

"pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
"pdfjsnewwindow": the pdfJsUrl and filename options
"dataurlnewwindow": the filename option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});

Patches

The vulnerability has been fixed in jspdf@4.2.1.

Workarounds

Sanitize user input before passing it to the output method.

Severity

CVSS Score: 9.6 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

parallax/jsPDF (jspdf)

`v4.2.1`

Compare Source

This release fixes two security issues.

What's Changed

Fix HTML Injection in output methods vulnerability.
Fix PDF Object Injection via free text annotation color vulnerability.

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

`v4.2.0`

Compare Source

This release fixes three security issues.

What's Changed

Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton children) vulnerability.
Fix Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions vulnerability.
Fix PDF Object Injection via Unsanitized Input in addJS Method vulnerability.
Add "default" property to export section in package.json by @stefan-schweiger in #3953

New Contributors

@stefan-schweiger made their first contribution in #3953

Full Changelog: parallax/jsPDF@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

This release fixes several security issues.

What's Changed

Upgrade optional dompurify dependency to 3.3.1 in #3948
Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution vulnerability
Fix Stored XMP Metadata Injection (Spoofing & Integrity Violation) vulnerability
Fix Shared State Race Condition in addJS Method vulnerability
Fix Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder vulnerability

Full Changelog: parallax/jsPDF@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

This release fixes a critical path traversal/local file inclusion security vulnerability in the jsPDF Node.js build. File system access is now restricted by default and can be enabled by either using node's --permission flag or the new jsPDF.allowFsRead property.

There are no other breaking changes.

Configuration

📅 Schedule: (in timezone America/Vancouver)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Thanks for the PR!

Deployments, as required, will be available below:

Please create PRs in draft mode. Mark as ready to enable:

Analysis Workflow

After merge, new images are deployed in:

Merge Workflow

renovate · 2026-01-05T19:03:11Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: frontend/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: jspdf-autotable@5.0.2
npm error Found: jspdf@4.2.1
npm error node_modules/jspdf
npm error   jspdf@"^4.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer jspdf@"^2 || ^3" from jspdf-autotable@5.0.2
npm error node_modules/jspdf-autotable
npm error   jspdf-autotable@"^5.0.2" from the root project
npm error
npm error Conflicting peer dependency: jspdf@3.0.4
npm error node_modules/jspdf
npm error   peer jspdf@"^2 || ^3" from jspdf-autotable@5.0.2
npm error   node_modules/jspdf-autotable
npm error     jspdf-autotable@"^5.0.2" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-24T16_17_22_403Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-24T16_17_22_403Z-debug-0.log

raarielgrace · 2026-07-24T16:42:50Z

Did this update in another PR, closing

renovate · 2026-07-24T16:43:59Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate Bot requested a review from lunamoonmoon as a code owner January 5, 2026 19:03

renovate Bot enabled auto-merge (squash) January 5, 2026 19:03

renovate Bot requested review from PaulGreywal and fergmac as code owners January 5, 2026 19:03

renovate Bot requested review from raarielgrace and wilwong89 as code owners January 5, 2026 19:03

renovate Bot temporarily deployed to dev January 5, 2026 19:05 Inactive

renovate Bot temporarily deployed to dev January 5, 2026 19:06 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from da38c9f to 7b8ae0b Compare January 12, 2026 17:30

renovate Bot temporarily deployed to dev January 12, 2026 17:32 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from 7b8ae0b to 954f19f Compare January 14, 2026 17:17

renovate Bot temporarily deployed to dev January 14, 2026 17:19 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from 954f19f to ecb609e Compare January 15, 2026 18:08

renovate Bot temporarily deployed to dev January 15, 2026 18:10 Inactive

renovate Bot had a problem deploying to dev January 15, 2026 18:10 Failure

renovate Bot temporarily deployed to dev January 15, 2026 18:10 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from ecb609e to e5dcdc1 Compare March 25, 2026 21:34

renovate Bot temporarily deployed to dev March 25, 2026 21:36 Inactive

renovate Bot temporarily deployed to dev March 25, 2026 21:37 Inactive

renovate Bot temporarily deployed to dev March 30, 2026 20:39 Inactive

renovate Bot changed the title ~~fix(deps): update dependency jspdf to v4 [security]~~ fix(deps): update dependency jspdf to v4 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency jspdf to v4 [security] - autoclosed~~ fix(deps): update dependency jspdf to v4 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch 2 times, most recently from 091e939 to 1c229b3 Compare April 27, 2026 22:36

renovate Bot temporarily deployed to dev April 27, 2026 22:39 Inactive

renovate Bot had a problem deploying to dev April 27, 2026 22:39 Error

renovate Bot temporarily deployed to dev April 27, 2026 22:39 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from 1c229b3 to 5e9985b Compare June 1, 2026 20:37

renovate Bot enabled auto-merge (squash) June 1, 2026 20:37

renovate Bot temporarily deployed to dev June 1, 2026 20:39 Inactive

renovate Bot temporarily deployed to dev June 1, 2026 20:40 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from 5e9985b to 3bfa2ef Compare June 1, 2026 21:11

renovate Bot temporarily deployed to dev June 1, 2026 21:14 Inactive

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from 3bfa2ef to e922734 Compare June 23, 2026 17:28

renovate Bot temporarily deployed to dev June 23, 2026 17:30 Inactive

fix(deps): update dependency jspdf to v4 [security]

14e1977

Navigation Menu

Uh oh!

fix(deps): update dependency jspdf to v4 [security] - #587

fix(deps): update dependency jspdf to v4 [security]#587
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-jspdf-vulnerability

renovate Bot commented Jan 5, 2026 •

edited by github-actions Bot

Loading

Uh oh!

renovate Bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

raarielgrace commented Jul 24, 2026

Uh oh!

renovate Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jan 5, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

jsPDF has Local File Inclusion/Path Traversal vulnerability

Details

Impact

Patches

Workarounds

Credits

Severity

References

jsPDF has Shared State Race Condition in addJS Plugin

Details

Impact

Patches

Workarounds

Severity

References

jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Details

Impact

Patches

Workarounds

Severity

References

jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

Details

Impact

Patches

Workarounds

Credits

Severity

References

jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

Details

Impact

Patches

Workarounds

Severity

References

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Details

Impact

Patches

Workarounds

References

Severity

References

jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

Details

Impact

Patches

Workarounds

References

Severity

References

jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

Details

Impact

Patches

Workarounds

Severity

References

jsPDF has a PDF Object Injection via FreeText color

Details

Impact

Patches

Workarounds

Severity

References

jsPDF has HTML Injection in New Window paths

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v4.2.1

renovate Bot commented Jan 5, 2026 •

edited by github-actions Bot

Loading

`v4.2.1`

`v4.2.0`

`v4.1.0`

`v4.0.0`

renovate Bot commented Jan 5, 2026 •

edited

Loading