{"id":"CVE-2026-31898","aliases":["CLSA-2026-1773620214","CLSA-2026-1775176117","CLSA-2026-1780534264","CLSA-2026-1780966320","EUVD-2026-12753","GHSA-7x6v-j9x4-qf24","ROOT-APP-NPM-CVE-2026-31898"],"status":"published","title":"jsPDF has a PDF Object Injection via FreeText color","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00378,"percentile":0.32244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-94"],"published":"2026-03-17T17:07:51Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"npm","package":"jspdf","fixed_in":["4.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"jspdf","fixed_in":["4.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jspdf","fixed_in":["4.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.2-tuxcare.0"},{"fixed":"2.5.2-tuxcare.8"}]}],"versions":["2.5.2","2.5.2-tuxcare.1","2.5.2-tuxcare.2","2.5.2-tuxcare.3","2.5.2-tuxcare.4","2.5.2-tuxcare.5","2.5.2-tuxcare.6","2.5.2-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.7"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3","3.0.4-tuxcare.4","3.0.4-tuxcare.5","3.0.4-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.1-tuxcare.0"},{"fixed":"2.5.1-tuxcare.1"}]}],"versions":["2.5.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.2"}]}],"versions":["1.4.1","1.4.1-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"jspdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-root.io.1"}]}]}],"products":[{"vendor":"parall","product":"jspdf"},{"vendor":"parallax","product":"jspdf"},{"vendor":"red hat","product":"red hat advanced cluster security 4.8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"}],"references":[{"url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.1","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31898","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448547","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31898.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31898","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7x6v-j9x4-qf24"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31898.json","tags":["advisory"]},{"url":"https://github.com/parallax/jsPDF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-31898","title":"jsPDF has a PDF Object Injection via FreeText color","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-18T03:03:43.469Z","modified":"2026-09-07T12:05:09.452Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-12753","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-18T03:03:43Z","modified":"2026-09-07T12:05:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-7x6v-j9x4-qf24","title":"jsPDF has a PDF Object Injection via FreeText color","description":"### Impact\n\nUser control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions.\n\nIf given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..\n\n* `createAnnotation`: `color` parameter\n\nExample attack vector:\n\n```js\nimport { jsPDF } from 'jspdf'\n\nconst doc = new jsPDF();\n\nconst payload = '000000) /AA \u003c\u003c/E \u003c\u003c/S /Launch /F (calc.exe)\u003e\u003e\u003e\u003e (';\n\ndoc.createAnnotation({\n  type: 'freetext',\n  bounds: { x: 10, y: 10, w: 120, h: 20 },\n  contents: 'hello',\n  color: payload\n});\n\ndoc.save('test.pdf');\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.2.1.\n\n### Workarounds\nSanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-17T17:07:51Z","modified":"2026-03-19T19:01:36Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:39:38.524712Z"}],"nvd":[{"id":"CVE-2026-31898","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-18T04:17:21.05Z","modified":"2026-08-18T12:18:06.21Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-31898","title":"jsPDF has a PDF Object Injection via FreeText color","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-18T03:03:43.469Z","modified":"2026-11-11T10:30:42.182471505Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-11T11:06:43.834798Z"},{"id":"GHSA-7x6v-j9x4-qf24","title":"jsPDF has a PDF Object Injection via FreeText color","description":"### Impact\n\nUser control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions.\n\nIf given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..\n\n* `createAnnotation`: `color` parameter\n\nExample attack vector:\n\n```js\nimport { jsPDF } from 'jspdf'\n\nconst doc = new jsPDF();\n\nconst payload = '000000) /AA \u003c\u003c/E \u003c\u003c/S /Launch /F (calc.exe)\u003e\u003e\u003e\u003e (';\n\ndoc.createAnnotation({\n  type: 'freetext',\n  bounds: { x: 10, y: 10, w: 120, h: 20 },\n  contents: 'hello',\n  color: payload\n});\n\ndoc.save('test.pdf');\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.2.1.\n\n### Workarounds\nSanitize user input before passing it to the vulnerable API members.","status":"published","published":"2026-03-17T17:07:51Z","modified":"2026-09-10T03:50:38.039654888Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"CLSA-2026-1773620214","title":"TuxCare security update for jspdf (2 CVEs)","description":"TuxCare rebuilt jspdf to address 2 CVEs. Fixed in 2.5.2-tuxcare.8.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:46.770794609Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775176117","title":"TuxCare security update for jspdf (2 CVEs)","description":"TuxCare rebuilt jspdf to address 2 CVEs. Fixed in 3.0.4-tuxcare.7.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:45:44.419326387Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1780534264","title":"TuxCare security update for jspdf (12 CVEs)","description":"TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.75648635Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780966320","title":"TuxCare security update for jspdf (9 CVEs)","description":"TuxCare rebuilt jspdf to address 9 CVEs. Fixed in 1.4.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.242378425Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"ROOT-APP-NPM-CVE-2026-31898","title":"CVE-2026-31898 in jspdf - Patched by Root","description":"Root has patched CVE-2026-31898 in the jspdf package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T04:07:07Z","modified":"2026-10-08T05:15:02.738562778Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}