PT-2026-2926 · Unknown · Html2Pdf.Js

Aydinnyunus · Published 2026-01-14 · Updated 2026-03-12 · CVE-2026-22787

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions html2pdf.js versions prior to 0.14.0

Description html2pdf.js converts webpages or elements into printable PDFs client-side. When provided with a text source instead of an element, versions prior to 0.14.0 do not sufficiently sanitize the text before attaching it to the Document Object Model (DOM). This allows malicious scripts to execute in the client browser, potentially compromising the confidentiality, integrity, and availability of the page’s data. An example attack vector involves using a malicious HTML string containing an img tag with an onerror event handler, such as <img src=x onerror="alert(document.cookie)">, to execute JavaScript code.

Recommendations Versions prior to 0.14.0 should be updated to version 0.14.0, which includes text source sanitization using DOMPurify. As a workaround, users of earlier versions must safely sanitize any text before using it as a source in html2pdf.js.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22787

GHSA-W8X4-X68C-M6FC

Affected Products

Html2Pdf.Js

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22787.json · Exploit
• 🔥 https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability · Exploit
• https://github.com/eKoopmans/html2pdf.js/pull/877 · Patch
• https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc · Vendor Advisory
• https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22787 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22787 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8x4-x68c-m6fc · Vendor Advisory
• https://github.com/eKoopmans/html2pdf.js/issues/865 · Note
• https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0 · Note
• https://github.com/eKoopmans/html2pdf.js · Note
• https://twitter.com/CVEnew/status/2011555163920875634 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011664478635430081 · Twitter Post
• https://t.me/cveNotify/155324 · Telegram Post
• https://twitter.com/dailycve/status/2032241225907011948 · Twitter Post