PT-2026-6655 · Jspdf+1 · Jspdf+1

Published 2026-02-04 · Updated 2026-02-05 · CVE-2026-25630

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.0.0 SurveyJS PDF Generator versions 1.12.58 and lower SurveyJS PDF Generator versions 2.5.4 and lower

Description A local file inclusion or path traversal issue was identified in jsPDF. Because SurveyJS PDF Generator depends on jsPDF, projects using SurveyJS PDF Generator v1.12.58 and lower or v2.5.4 and lower could be affected. No other SurveyJS PDF Generator dependencies are affected.

Recommendations Upgrade SurveyJS PDF Generator to version 1.12.59 or later. Upgrade SurveyJS PDF Generator to version 2.5.5 or later. Upgrade jsPDF to version 4.0.0 or later.

Fix

Weakness Enumeration

CWE-35

CWE-73

Related Identifiers

CVE-2026-25630

GHSA-H3Q6-JFRG-3X6Q

Affected Products

Surveyjs Pdf Generator

Jspdf

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25630 · Security Note
• https://osv.dev/vulnerability/GHSA-h3q6-jfrg-3x6q · Vendor Advisory
• https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2 · Note
• https://github.com/surveyjs/survey-pdf · Note
• https://github.com/surveyjs/survey-pdf/security/advisories/GHSA-h3q6-jfrg-3x6q · Note
• https://t.me/CVEtracker/43864 · Telegram Post