CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in [email protected]. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
| CWE | CWE-94 CWE-116 |
| Vendor | parallax |
| Product | jspdf |
| Published | Feb 19, 2026 |
| Last Updated | Feb 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for parallax jspdf
Be the first to know when new high vulnerabilities affecting parallax jspdf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
parallax / jsPDF
< 4.2.0
References
github.com: https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp github.com: https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437 github.com: https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md github.com: https://github.com/parallax/jsPDF/releases/tag/v4.2.0