PT-2026-2926 · Unknown · Html2Pdf.Js

Aydinnyunus · Publicado 2026-01-14 · Atualizado 2026-03-12 · CVE-2026-22787

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions html2pdf.js versions prior to 0.14.0

Description html2pdf.js converts webpages or elements into printable PDFs client-side. When provided with a text source instead of an element, versions prior to 0.14.0 do not sufficiently sanitize the text before attaching it to the Document Object Model (DOM). This allows malicious scripts to execute in the client browser, potentially compromising the confidentiality, integrity, and availability of the page’s data. An example attack vector involves using a malicious HTML string containing an img tag with an onerror event handler, such as <img src=x onerror="alert(document.cookie)">, to execute JavaScript code.

Recommendations Versions prior to 0.14.0 should be updated to version 0.14.0, which includes text source sanitization using DOMPurify. As a workaround, users of earlier versions must safely sanitize any text before using it as a source in html2pdf.js.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22787

GHSA-W8X4-X68C-M6FC

Produtos afetados

Html2Pdf.Js

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22787.json · Exploit
• 🔥 https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability · Exploit
• https://github.com/eKoopmans/html2pdf.js/pull/877 · Correção
• https://github.com/eKoopmans/html2pdf.js/issues/865 · Nota
• https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc · Aviso do Fabricante
• https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0 · Nota
• https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b · Correção
• https://github.com/eKoopmans/html2pdf.js · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22787 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011555163920875634 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2011664478635430081 · Publicação no Twitter
• https://t.me/cveNotify/155324 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-22787 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w8x4-x68c-m6fc · Aviso do Fabricante
• https://twitter.com/dailycve/status/2032241225907011948 · Publicação no Twitter