CVE-2026-31898
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Summary
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| parallax | jsPDF | < 4.2.1 | affected |
Weaknesses
- CWE-116: CWE-116: Improper Encoding or Escaping of Output
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
jspdf: jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method
Additional References
- https://access.redhat.com/security/cve/CVE-2026-31898
- https://bugzilla.redhat.com/show_bug.cgi?id=2448547
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31898.json
- https://access.redhat.com/errata/RHSA-2026:7110
- https://access.redhat.com/errata/RHSA-2026:7128
References
- https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24
- https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8
- https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208
- https://github.com/parallax/jsPDF/releases/tag/v4.2.1
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.