{"id":"CVE-2026-25755","aliases":["CLSA-2026-1773620207","CLSA-2026-1773620213","CLSA-2026-1780534264","CLSA-2026-1780966320","EUVD-2026-8109","GHSA-9vjf-qc39-jprp","ROOT-APP-NPM-CVE-2026-25755"],"status":"published","title":"jsPDF has PDF Object Injection via Unsanitized Input in addJS Method","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00952,"percentile":0.61753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-116","CWE-94"],"published":"2026-02-19T14:41:46Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"pocgithub","id":"absholi7ly/jsPDF-Object-Injection","title":"absholi7ly/jsPDF-Object-Injection","date":"2026-02-24","url":"https://github.com/absholi7ly/jsPDF-Object-Injection"}],"fixes":[{"ecosystem":"npm","package":"jspdf","fixed_in":["4.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"jspdf","fixed_in":["2.5.2-aikido.1","4.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jspdf","fixed_in":["2.5.2-root.io.1","4.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.6"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3","3.0.4-tuxcare.4","3.0.4-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.2-tuxcare.0"},{"fixed":"2.5.2-tuxcare.7"}]}],"versions":["2.5.2","2.5.2-tuxcare.1","2.5.2-tuxcare.2","2.5.2-tuxcare.3","2.5.2-tuxcare.4","2.5.2-tuxcare.5","2.5.2-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.1-tuxcare.0"},{"fixed":"2.5.1-tuxcare.1"}]}],"versions":["2.5.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.2"}]}],"versions":["1.4.1","1.4.1-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"jspdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-aikido.1"},{"fixed":"4.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-root.io.1"},{"fixed":"4.0.0-root.io.1"}]}]}],"products":[{"vendor":"parall","product":"jspdf"},{"vendor":"parallax","product":"jspdf"},{"vendor":"red hat","product":"red hat advanced cluster security 4.8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"}],"references":[{"url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","tags":["x_refsource_MISC","Exploit","Mitigation","Third Party Advisory","web"]},{"url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25755","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440993","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25755.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25755","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vjf-qc39-jprp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25755.json","tags":["advisory"]},{"url":"https://github.com/parallax/jsPDF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25755","title":"jsPDF has PDF Object Injection via Unsanitized Input in addJS Method","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.","status":"published","published":"2026-02-19T14:41:46.941Z","modified":"2026-09-07T12:05:03.219Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94","CWE-116","CWE-94"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-8109","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.","status":"published","published":"2026-02-19T14:41:46Z","modified":"2026-09-07T12:05:03Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-9vjf-qc39-jprp","title":"jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method","description":"### Impact\n\nUser control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.\n\n```js\nimport { jsPDF } from \"jspdf\";\nconst doc = new jsPDF();\n// Payload:\n// 1. ) closes the JS string.\n// 2. \u003e closes the current dictionary.\n// 3. /AA ... injects an \"Additional Action\" that executes on focus/open.\nconst maliciousPayload = \"console.log('test');) \u003e\u003e /AA \u003c\u003c /O \u003c\u003c /S /JavaScript /JS (app.alert('Hacked!')) \u003e\u003e \u003e\u003e\";\n\ndoc.addJS(maliciousPayload);\ndoc.save(\"vulnerable.pdf\");\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.0.\n\n### Workarounds\nEscape parentheses in user-provided JavaScript code before passing them to the `addJS` method.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","status":"published","published":"2026-02-19T19:32:36Z","modified":"2026-02-19T19:32:37Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-25755","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.","status":"published","published":"2026-02-19T15:16:12.303Z","modified":"2026-08-18T12:17:55.89Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-25755","title":"jsPDF has PDF Object Injection via Unsanitized Input in addJS Method","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.","status":"published","published":"2026-02-19T14:41:46.941Z","modified":"2026-10-28T02:30:30.660143347Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-9vjf-qc39-jprp","title":"jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method","description":"### Impact\n\nUser control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.\n\n```js\nimport { jsPDF } from \"jspdf\";\nconst doc = new jsPDF();\n// Payload:\n// 1. ) closes the JS string.\n// 2. \u003e closes the current dictionary.\n// 3. /AA ... injects an \"Additional Action\" that executes on focus/open.\nconst maliciousPayload = \"console.log('test');) \u003e\u003e /AA \u003c\u003c /O \u003c\u003c /S /JavaScript /JS (app.alert('Hacked!')) \u003e\u003e \u003e\u003e\";\n\ndoc.addJS(maliciousPayload);\ndoc.save(\"vulnerable.pdf\");\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.0.\n\n### Workarounds\nEscape parentheses in user-provided JavaScript code before passing them to the `addJS` method.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","status":"published","published":"2026-02-19T19:32:36Z","modified":"2026-09-10T03:50:59.366092981Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CLSA-2026-1773620207","title":"TuxCare security update for jspdf (3 CVEs)","description":"TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 3.0.4-tuxcare.6.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:46.836381443Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773620213","title":"TuxCare security update for jspdf (3 CVEs)","description":"TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 2.5.2-tuxcare.7.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:47.178165437Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1780534264","title":"TuxCare security update for jspdf (12 CVEs)","description":"TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.75648635Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780966320","title":"TuxCare security update for jspdf (9 CVEs)","description":"TuxCare rebuilt jspdf to address 9 CVEs. Fixed in 1.4.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.242378425Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"ROOT-APP-NPM-CVE-2026-25755","title":"CVE-2026-25755 in jspdf - Patched by Root","description":"Root has patched CVE-2026-25755 in the jspdf package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T04:07:07Z","modified":"2026-10-08T05:15:03.148703857Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}