PT-2026-5716 · Jspdf · Jspdf

Karimtantawey · Published 2026-02-02 · Updated 2026-02-02 · CVE-2026-24040

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.1.0

Description jsPDF is a JavaScript library used to generate PDF documents. A flaw exists in the addJS method within the Node.js build, versions prior to 4.1.0, due to the use of a shared module-scoped variable (text) for storing JavaScript content. In concurrent environments, such as Node.js web servers, this shared variable can lead to Cross-User Data Leakage. Specifically, JavaScript content intended for one user may be overwritten by content from another request before the PDF is fully generated, resulting in a PDF for User A containing the JavaScript payload meant for User B. This issue primarily affects server-side environments, but similar race conditions could potentially occur in client-side implementations.

Recommendations Update to jsPDF version 4.1.0 or later.

Exploit

Fix

Information Disclosure

Race Condition

Weakness Enumeration

CWE-200

CWE-362

Related Identifiers

CVE-2026-24040

GHSA-CJW8-79X6-5CJ4

Affected Products

Jspdf

References · 9

• 🔥 https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24040.json · Exploit
• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e · Patch
• https://osv.dev/vulnerability/CVE-2026-24040 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjw8-79x6-5cj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24040 · Security Note
• https://github.com/parallax/jsPDF · Note
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0 · Note
• https://twitter.com/CVEnew/status/2018465529854362079 · Twitter Post