CVE-2026-24737

HIGH 8.1

jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in [email protected].

CWE	CWE-116
Vendor	parallax
Product	jspdf
Published	Feb 2, 2026
Last Updated	Jun 30, 2026

Stay Ahead of the Next One

Get instant alerts for parallax jspdf

Be the first to know when new high vulnerabilities affecting parallax jspdf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

parallax / jsPDF

< 4.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328 github.com: https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79 github.com: https://github.com/parallax/jsPDF/releases/tag/v4.1.0 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-24737 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2436115 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24737.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4466 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4467