jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-24737 · CVE overview and exploitation status

EUVD-2026-5297

GHSA-pqxr-3g65-p328

cve-program · CVE-2026-24737

• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

euvd · EUVD-2026-5297

• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

nvd · CVE-2026-24737

• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0
• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
• https://access.redhat.com/errata/RHSA-2026:4466
• https://access.redhat.com/errata/RHSA-2026:4467
• https://access.redhat.com/security/cve/CVE-2026-24737
• https://bugzilla.redhat.com/show_bug.cgi?id=2436115
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24737.json

osv · GHSA-pqxr-3g65-p328

• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
• https://nvd.nist.gov/vuln/detail/CVE-2026-24737
• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
• https://github.com/parallax/jsPDF
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

• jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsa… · Advisory content revised · 15 Nov 2026