PT-2025-11639 · Jspdf · Jspdf

Published 2025-03-05 · Updated 2025-03-18 · CVE-2025-29907

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 3.0.1

Description The issue allows user control of the first argument of the addImage method, resulting in high CPU utilization and denial of service. If unsanitized image URLs are passed to the addImage method, a user can provide a harmful data-url that causes high CPU utilization and denial of service. Other affected methods include html and addSvgAsImage.

Recommendations For jsPDF versions prior to 3.0.1, upgrade to jsPDF 3.0.1 or later to fix the issue. As a temporary workaround, consider sanitizing image URLs before passing them to the addImage method or other affected methods, such as html and addSvgAsImage.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2025-08460

CVE-2025-29907

GHSA-W532-JXJH-HJHJ

Affected Products

Jspdf

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29907.json · Exploit
• https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj · Vendor Advisory
• https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df · Patch
• https://osv.dev/vulnerability/CVE-2025-29907 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w532-jxjh-hjhj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29907 · Security Note
• https://bdu.fstec.ru/vul/2025-08460 · Security Note
• https://wiki.astralinux.ru/x/ziLoD · Vendor Advisory
• https://github.com/parallax/jsPDF · Note
• https://twitter.com/CveFindCom/status/1902072983914463682 · Twitter Post
• https://t.me/cvedetector/20600 · Telegram Post
• https://lk.astra.ru · Note
• https://twitter.com/CVEnew/status/1902071493745344901 · Twitter Post
• https://t.me/cvetracker/19401 · Telegram Post