PT-2026-25976 · Jspdf · Jspdf

Sofianeelhor · Publicado 2026-03-17 · Atualizado 2026-03-25 · CVE-2026-31898

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1

Description jsPDF is a JavaScript library used to generate PDF documents. A flaw exists where user-controlled arguments within the createAnnotation method can allow the injection of arbitrary PDF objects, including JavaScript actions. If unsanitized input is provided to the createAnnotation method, specifically the color parameter, malicious code can be injected. This injected code may execute when the PDF is opened or interacted with. An example attack vector involves crafting a payload that, when used as the color value in createAnnotation, can trigger the execution of arbitrary commands, such as calc.exe.

Recommendations Versions prior to 4.2.1 should be updated to version 4.2.1 or later. Sanitize user input before passing it to the createAnnotation method.

Exploit

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

BDU:2026-05059

CVE-2026-31898

GHSA-7X6V-J9X4-QF24

Produtos afetados

Jspdf

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31898.json · Exploit
• https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24 · Aviso do Fabricante
• https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208 · Correção
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1 · Nota
• https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8 · Correção
• https://github.com/parallax/jsPDF · Nota
• https://twitter.com/integ_sec/status/2036819376163242448 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2034177460057870674 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31898 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2034140182241276104 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034136415202668949 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-7x6v-j9x4-qf24 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31898 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034280956211638311 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2034248527539548310 · Publicação no Twitter