PT-2026-25977 · Jspdf · Jspdf

Sofianeelhor · Published 2026-03-17 · Updated 2026-03-19 · CVE-2026-31938

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1

Description jsPDF, a JavaScript library used for generating PDFs, contains a flaw where insufficient sanitization of user-controlled input within the options argument of the output function allows attackers to inject arbitrary HTML, including scripts, into the browser context when a generated PDF is opened. This can lead to the execution of malicious code within the victim's browser, potentially allowing attackers to extract or modify sensitive information. The vulnerability affects the "pdfobjectnewwindow", "pdfjsnewwindow", and "dataurlnewwindow" overloads, specifically impacting the pdfObjectUrl, pdfJsUrl, and filename options. An example attack vector involves crafting a malicious payload within the filename option to inject a script tag.

Recommendations Upgrade to jsPDF version 4.2.1 or sanitize user input before passing it to the output method.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-03346

CVE-2026-31938

GHSA-WFV2-PWC8-CRG5

Affected Products

Jspdf

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31938.json · Exploit
• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7 · Patch
• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31938 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfv2-pwc8-crg5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31938 · Security Note
• https://bdu.fstec.ru/vul/2026-03346 · Security Note
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1 · Note
• https://github.com/parallax/jsPDF · Note
• https://reddit.com/r/pwnhub/comments/1rxfbe7/critical_html_injection_found_in_jspdf_affects · Reddit Post
• https://twitter.com/the_yellow_fall/status/2034635754375110681 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034248202703278426 · Twitter Post
• https://twitter.com/CVEarity/status/2034153682217116066 · Twitter Post
• https://twitter.com/0dayPublishing/status/2034108562981400754 · Twitter Post
• https://twitter.com/CVEnew/status/2034136414225326410 · Twitter Post