PT-2026-5717 · Jspdf · Jspdf

Karimtantawey · Published 2026-02-02 · Updated 2026-02-02 · CVE-2026-24043

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.1.0

Description jsPDF is a JavaScript library used to generate PDF documents. A flaw exists due to user-controlled input to the addMetadata function, allowing arbitrary XML injection. If unsanitized input is provided to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. This can compromise the integrity of the PDF if it is subsequently signed or processed. The example attack vector demonstrates injecting a fake "dc:creator" (Author) to spoof the document source. The vulnerable function is addMetadata. The first argument of the addMetadata function is the vulnerable parameter.

Recommendations Versions prior to 4.1.0 should be updated to version 4.1.0 or later. Sanitize user input before passing it to the addMetadata method by escaping XML entities. For example, replace '&' with '&', '<' with '<', '>' with '>', '"' with '"', and "'" with '''.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-20

CWE-74

Related Identifiers

CVE-2026-24043

GHSA-VM32-VV63-W422

Affected Products

Jspdf

References · 9

• 🔥 https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24043.json · Exploit
• https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff · Patch
• https://osv.dev/vulnerability/CVE-2026-24043 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vm32-vv63-w422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24043 · Security Note
• https://github.com/parallax/jsPDF · Note
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0 · Note
• https://twitter.com/CVEnew/status/2018465530957451762 · Twitter Post