No access to your tenant or devices. Every item links to its source. What this means
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in [email protected].
Read the publisher's advisoryjsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in [email protected].
Read the publisher's advisoryjsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in [email protected].
Read the publisher's advisory### Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are: * `AcroformChoiceField.addOption` * `AcroformChoiceField.setOptions` * `AcroFormCheckBox.appearanceState` * `AcroFormRadioButton.appearanceState` Example attack vector: ```js import { jsPDF } from "jspdf" const doc = new jsPDF(); var choiceField = new doc.AcroFormChoiceField(); choiceField.T = "VulnerableField"; choiceField.x = 20; choiceField.y = 20; choiceField.width = 100; choiceField.height = 20; // PAYLOAD: // 1. Starts with "/" to bypass escaping. // 2. "dummy]" closes the array. // 3. "/AA" injects an Additional Action (Focus event). // 4. "/JS" executes arbitrary JavaScript. const payload = "/dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage ["; choiceField.addOption(payload); doc.addField(choiceField); doc.save("test.pdf"); ``` ### Patches The vulnerability has been fixed in [email protected]. ### Workarounds Sanitize user input before passing it to the vulnerable API members. ### Credits Research and fix: Ahmet Artuç
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "parallax",
"product": "jsPDF",
"versions": [
{
"version": "< 4.1.0",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: Feb 2, 2026, 8:29:05 PM
dateUpdated: Aug 18, 2026, 12:05:36 PM
RHSA-2026:4466: Red Hat Security Advisory: RHACS 4.8.9 security and bug fix update
CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-68121 · CVE-2026-21441 · CVE-2026-24040 · CVE-2026-24737
WID-SEC-W-2026-2933: Splunk SOAR: Mehrere Schwachstellen
CVE-2025-13465 · CVE-2025-13473 · CVE-2025-14550 · CVE-2025-15599 · CVE-2025-53859 · CVE-2025-6545 · CVE-2025-6547 · CVE-2025-66221 · CVE-2025-67724 · CVE-2025-67725 · CVE-2025-67726 · CVE-2025-68428 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-1207 · CVE-2026-1285 · CVE-2026-1287 · CVE-2026-1312 · CVE-2026-1642 · CVE-2026-2004 · CVE-2026-2005 · CVE-2026-2006 · CVE-2026-21226 · CVE-2026-21860 · CVE-2026-22702 · CVE-2026-22815 · CVE-2026-2391 · CVE-2026-24001 · CVE-2026-24040 · CVE-2026-24043 · CVE-2026-24133 · CVE-2026-24737 · CVE-2026-25535 · CVE-2026-25673 · CVE-2026-25674 · CVE-2026-25755 · CVE-2026-25940 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27199 · CVE-2026-2739 · CVE-2026-27651 · CVE-2026-27654 · CVE-2026-27784 · CVE-2026-27959 · CVE-2026-28277 · CVE-2026-28684 · CVE-2026-28753 · CVE-2026-28755 · CVE-2026-29063 · CVE-2026-2950 · CVE-2026-30922 · CVE-2026-31898 · CVE-2026-31938 · CVE-2026-31958 · CVE-2026-32141 · CVE-2026-32597 · CVE-2026-32647 · CVE-2026-33228 · CVE-2026-33532 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33750 · CVE-2026-34513 · CVE-2026-34514 · CVE-2026-34515 · CVE-2026-34516 · CVE-2026-34517 · CVE-2026-34518 · CVE-2026-34519 · CVE-2026-34520 · CVE-2026-34525 · CVE-2026-34601 · CVE-2026-35536 · CVE-2026-40087 · CVE-2026-40460 · CVE-2026-40701 · CVE-2026-41066 · CVE-2026-42215 · CVE-2026-42284 · CVE-2026-42934 · CVE-2026-42945 · CVE-2026-42946 · CVE-2026-44243 · CVE-2026-44244 · CVE-2026-4800 · CVE-2026-76356 · CVE-2026-76357 · CVE-2026-76358 · CVE-2026-76359 · CVE-2026-76360 · CVE-2026-76361 · CVE-2026-76362 · CVE-2026-76363 · CVE-2026-76364 · CVE-2026-76365 · CVE-2026-76366 · CVE-2026-76367 · CVE-2026-76368 · CVE-2026-76369 · CVE-2026-76370 · CVE-2026-9256
RHSA-2026:4467: Red Hat Security Advisory: RHACS 4.9.4 security and bug fix update
CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-68121 · CVE-2026-21441 · CVE-2026-24040 · CVE-2026-24737
WID-SEC-W-2026-0553: HCL BigFix: Mehrere Schwachstellen
CVE-2025-68428 · CVE-2026-22029 · CVE-2026-24040 · CVE-2026-24043 · CVE-2026-24133 · CVE-2026-24737 · CVE-2026-25639
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Modified
Weakness classifications: CWE-116 · CWE-917
published: 2026-02-02T23:16:08.443
lastModified: 2026-08-18T12:17:44.733
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
npm
SEMVER · introduced 0 → fixed 4.1.0
Original source record · Cite this exact observation · Complete original publisher JSON