PT-2025-34787 · Jspdf · Jspdf

Aleksey Solovev · Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-57810

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: jsPDF versions prior to 3.0.2

Description: jsPDF is a JavaScript library used to generate PDFs. Prior to version 3.0.2, user control over the first argument of the addImage method can lead to high CPU utilization and denial of service. Providing unsanitized image data or URLs to the addImage method allows a user to supply a malicious PNG file, resulting in excessive CPU usage and a denial-of-service condition.

Recommendations: Update to jsPDF version 3.0.2 or later.

Exploit

Fix

DoS

Infinite Loop

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-835

CWE-770

CWE-20

Related Identifiers

BDU:2025-11395

CVE-2025-57810

GHSA-8MVJ-3J78-4QMW

Affected Products

Jspdf

References · 16

• 🔥 https://github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57810.json · Exploit
• https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9 · Patch
• https://osv.dev/vulnerability/GHSA-8mvj-3j78-4qmw · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11395 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-57810 · Security Note
• https://wiki.astralinux.ru/x/ziLoD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57810 · Vendor Advisory
• https://github.com/parallax/jsPDF · Note
• https://github.com/parallax/jsPDF/pull/3880 · Note
• https://github.com/parallax/jsPDF/releases/tag/v3.0.2 · Note
• https://twitter.com/VulmonFeeds/status/1960453142996218247 · Twitter Post
• https://t.me/CVEtracker/30941 · Telegram Post
• https://twitter.com/CVEnew/status/1960369278927966477 · Twitter Post
• https://twitter.com/CveFindCom/status/1960374472948449550 · Twitter Post