PT-2026-25977 · Jspdf · Jspdf

Sofianeelhor · Publicado 2026-03-17 · Atualizado 2026-03-19 · CVE-2026-31938

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1

Description jsPDF, a JavaScript library used for generating PDFs, contains a flaw where insufficient sanitization of user-controlled input within the options argument of the output function allows attackers to inject arbitrary HTML, including scripts, into the browser context when a generated PDF is opened. This can lead to the execution of malicious code within the victim's browser, potentially allowing attackers to extract or modify sensitive information. The vulnerability affects the "pdfobjectnewwindow", "pdfjsnewwindow", and "dataurlnewwindow" overloads, specifically impacting the pdfObjectUrl, pdfJsUrl, and filename options. An example attack vector involves crafting a malicious payload within the filename option to inject a script tag.

Recommendations Upgrade to jsPDF version 4.2.1 or sanitize user input before passing it to the output method.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-03346

CVE-2026-31938

GHSA-WFV2-PWC8-CRG5

Produtos afetados

Jspdf

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31938.json · Exploit
• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7 · Correção
• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5 · Aviso do Fabricante
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1 · Nota
• https://github.com/parallax/jsPDF · Nota
• https://osv.dev/vulnerability/CVE-2026-31938 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wfv2-pwc8-crg5 · Aviso do Fabricante
• https://reddit.com/r/pwnhub/comments/1rxfbe7/critical_html_injection_found_in_jspdf_affects · Publicação no Reddit
• https://twitter.com/the_yellow_fall/status/2034635754375110681 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31938 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2034248202703278426 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2034153682217116066 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2034108562981400754 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034136414225326410 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-03346 · Nota de Segurança