Every CVE Search/ Get API key

CVE-2026-24043

jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

6.9 MediumFix available

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.29%Up 0.3 points since Feb 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

Record
CVE-2026-24043
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2026-5294 6.9

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

Record
EUVD-2026-5294
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vm32-vv63-w422 6.9

jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Impact

User control of the first argument of the addMetadata function allows users to inject arbitrary XML.

If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed.

Example attack vector:

import { jsPDF } from "jspdf"

const doc = new jsPDF()

// Input a string that closes the current XML tag and opens a new one.
// We are injecting a fake "dc:creator" (Author) to spoof the document source.
const maliciousInput = '</jspdf:metadata></rdf:Description>' +
    '<rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/">' +
    '<dc:creator>TRUSTED_ADMINISTRATOR</dc:creator>' + // <--- Spoofed Identity
    '</rdf:Description>' +
    '<rdf:Description><jspdf:metadata>'

// The application innocently adds the user's input to the metadata
doc.addMetadata(maliciousInput, "http://valid.namespace")

doc.save("test.pdf")

Patches

The vulnerability has been fixed in [email protected]

Workarounds

Sanitize user input before passing it to the addMetadata method: escape XML entities. For example:

let input = "..."

input = input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&apos;")

doc.addMetadata(input)
Record
GHSA-vm32-vv63-w422
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-20, CWE-74
Updated
2026-11-02
NVD 6.9

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

Record
CVE-2026-24043
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSV 6.9

jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

Record
CVE-2026-24043
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-74
Updated
2026-11-02
OSVGHSA-vm32-vv63-w422 6.9

jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Impact

User control of the first argument of the addMetadata function allows users to inject arbitrary XML.

If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed.

Example attack vector:

import { jsPDF } from "jspdf"

const doc = new jsPDF()

// Input a string that closes the current XML tag and opens a new one.
// We are injecting a fake "dc:creator" (Author) to spoof the document source.
const maliciousInput = '</jspdf:metadata></rdf:Description>' +
    '<rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/">' +
    '<dc:creator>TRUSTED_ADMINISTRATOR</dc:creator>' + // <--- Spoofed Identity
    '</rdf:Description>' +
    '<rdf:Description><jspdf:metadata>'

// The application innocently adds the user's input to the metadata
doc.addMetadata(maliciousInput, "http://valid.namespace")

doc.save("test.pdf")

Patches

The vulnerability has been fixed in [email protected]

Workarounds

Sanitize user input before passing it to the addMetadata method: escape XML entities. For example:

let input = "..."

input = input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&apos;")

doc.addMetadata(input)
Record
GHSA-vm32-vv63-w422
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-20, CWE-74
Updated
2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1773447392 No score

TuxCare security update for jspdf (4 CVEs)

TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 3.0.4-tuxcare.4.

Record
CLSA-2026-1773447392
Updated
2026-11-02
OSVCLSA-2026-1773620212 No score

TuxCare security update for jspdf (4 CVEs)

TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 2.5.2-tuxcare.6.

Record
CLSA-2026-1773620212
Updated
2026-11-02
OSVCLSA-2026-1780534264 No score

TuxCare security update for jspdf (12 CVEs)

TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1.

Record
CLSA-2026-1780534264
Updated
2026-11-02
OSVCLSA-2026-1780966320 No score

TuxCare security update for jspdf (9 CVEs)

TuxCare rebuilt jspdf to address 9 CVEs. Fixed in 1.4.1-tuxcare.2.

Record
CLSA-2026-1780966320
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jspdf
npm
 through 4.0.0
4.1.0
jspdf
TuxCare:npm
From an advisory covering 4 CVEs
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3
3.0.4-tuxcare.4
jspdf
TuxCare:npm
From an advisory covering 4 CVEs
 2.5.2-tuxcare.0 up to 2.5.2-tuxcare.6, plus listed versions
2.5.22.5.2-tuxcare.12.5.2-tuxcare.22.5.2-tuxcare.32.5.2-tuxcare.42.5.2-tuxcare.5
2.5.2-tuxcare.6
jspdf
TuxCare:npm
From an advisory covering 12 CVEs
 2.5.1-tuxcare.0 up to 2.5.1-tuxcare.1, plus listed versions
2.5.1
2.5.1-tuxcare.1
jspdf
TuxCare:npm
From an advisory covering 9 CVEs
 1.4.1-tuxcare.0 up to 1.4.1-tuxcare.2, plus listed versions
1.4.11.4.1-tuxcare.1
1.4.1-tuxcare.2
jspdf
npm
 before 4.1.0
4.1.0

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24043 is a medium vulnerability (CVSS 6.9) in Parall Jspdf, published February 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in jspdf 4.1.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open