jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.
The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Parall Jspdf
cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*
|
— |
4.2.0
|
References 9
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md
security-advisories@github.com
https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd54…
security-advisories@github.com
https://github.com/parallax/jsPDF/releases/tag/v4.2.0
security-advisories@github.com
https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp
security-advisories@github.com
https://access.redhat.com/errata/RHSA-2026:7110
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:7128
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/security/cve/CVE-2026-25755
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://bugzilla.redhat.com/show_bug.cgi?id=2440993
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25755.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c