PT-2026-20852 · Jspdf · Jspdf

Macabely · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-25940

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.0

Description jsPDF is a JavaScript library used to generate PDF documents. Prior to version 4.2.0, the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions, through user-controlled input. This can lead to the execution of these actions when a user interacts with the PDF, such as hovering over a radio option. The vulnerability stems from a lack of sanitization of input passed to the Acroform module's properties and methods.

Recommendations Versions prior to 4.2.0 should be updated to version 4.2.0 or later. As a workaround, sanitize user input before passing it to the vulnerable API members of the Acroform module.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-25940

GHSA-P5XG-68WR-HM3M

Affected Products

Jspdf

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25940.json · Exploit
• https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375 · Patch
• https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5xg-68wr-hm3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25940 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25940 · Vendor Advisory
• https://github.com/parallax/jsPDF · Note
• https://github.com/parallax/jsPDF/releases/tag/v4.2.0 · Note
• https://twitter.com/CveTodo/status/2024526952833434023 · Twitter Post
• https://twitter.com/CVEnew/status/2025892056023945692 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024540613924802772 · Twitter Post
• https://t.me/cveNotify/152914 · Telegram Post
• https://twitter.com/TheHackerWire/status/2024522069153910824 · Twitter Post
• https://t.me/CVEtracker/45140 · Telegram Post