PT-2026-5721 · Jspdf · Jspdf

Ahmetartuc · Published 2026-02-02 · Updated 2026-02-18 · CVE-2026-24737

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.1.0

Description A flaw exists in jsPDF, a JavaScript library for generating PDFs, where user control over properties and methods within the Acroform module can lead to the injection of arbitrary PDF objects, including JavaScript actions. Successful exploitation allows an attacker to execute code when a victim opens the document. The vulnerable API members include AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. These methods and properties, when provided with unsanitized input, permit the injection of malicious content.

Recommendations Update to jsPDF version 4.1.0 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-01175

CVE-2026-24737

GHSA-PQXR-3G65-P328

Affected Products

Jspdf

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24737.json · Exploit
• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79 · Patch
• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24737 · Security Note
• https://osv.dev/vulnerability/GHSA-pqxr-3g65-p328 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01175 · Security Note
• https://github.com/parallax/jsPDF · Note
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0 · Note
• https://twitter.com/CVEnew/status/2018465533276889467 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018499649271734782 · Twitter Post
• https://t.me/cveNotify/152324 · Telegram Post