PT-2026-25976 · Jspdf · Jspdf

Sofianeelhor · Published 2026-03-17 · Updated 2026-03-25 · CVE-2026-31898

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1

Description jsPDF is a JavaScript library used to generate PDF documents. A flaw exists where user-controlled arguments within the createAnnotation method can allow the injection of arbitrary PDF objects, including JavaScript actions. If unsanitized input is provided to the createAnnotation method, specifically the color parameter, malicious code can be injected. This injected code may execute when the PDF is opened or interacted with. An example attack vector involves crafting a payload that, when used as the color value in createAnnotation, can trigger the execution of arbitrary commands, such as calc.exe.

Recommendations Versions prior to 4.2.1 should be updated to version 4.2.1 or later. Sanitize user input before passing it to the createAnnotation method.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-05059

CVE-2026-31898

GHSA-7X6V-J9X4-QF24

Affected Products

Jspdf

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31898.json · Exploit
• https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24 · Vendor Advisory
• https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208 · Patch
• https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31898 · Security Note
• https://osv.dev/vulnerability/GHSA-7x6v-j9x4-qf24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31898 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05059 · Security Note
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1 · Note
• https://github.com/parallax/jsPDF · Note
• https://twitter.com/integ_sec/status/2036819376163242448 · Twitter Post
• https://twitter.com/CVEarity/status/2034177460057870674 · Twitter Post
• https://twitter.com/cyberbivash/status/2034140182241276104 · Twitter Post
• https://twitter.com/CVEnew/status/2034136415202668949 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034280956211638311 · Twitter Post