PT-2026-5721 · Jspdf · Jspdf

Ahmetartuc · Publicado 2026-02-02 · Atualizado 2026-02-18 · CVE-2026-24737

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.1.0

Description A flaw exists in jsPDF, a JavaScript library for generating PDFs, where user control over properties and methods within the Acroform module can lead to the injection of arbitrary PDF objects, including JavaScript actions. Successful exploitation allows an attacker to execute code when a victim opens the document. The vulnerable API members include AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. These methods and properties, when provided with unsanitized input, permit the injection of malicious content.

Recommendations Update to jsPDF version 4.1.0 or later.

Exploit

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

BDU:2026-01175

CVE-2026-24737

GHSA-PQXR-3G65-P328

Produtos afetados

Jspdf

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24737.json · Exploit
• https://github.com/parallax/jsPDF · Nota
• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79 · Correção
• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328 · Aviso do Fabricante
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-24737 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24737 · Nota de Segurança
• https://twitter.com/CVEnew/status/2018465533276889467 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2018499649271734782 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-pqxr-3g65-p328 · Aviso do Fabricante
• https://t.me/cveNotify/152324 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2026-01175 · Nota de Segurança