{"id":"GHSA-9vjf-qc39-jprp","summary":"jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method","details":"### Impact\n\nUser control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.\n\n```js\nimport { jsPDF } from \"jspdf\";\nconst doc = new jsPDF();\n// Payload:\n// 1. ) closes the JS string.\n// 2. \u003e closes the current dictionary.\n// 3. /AA ... injects an \"Additional Action\" that executes on focus/open.\nconst maliciousPayload = \"console.log('test');) \u003e\u003e /AA \u003c\u003c /O \u003c\u003c /S /JavaScript /JS (app.alert('Hacked!')) \u003e\u003e \u003e\u003e\";\n\ndoc.addJS(maliciousPayload);\ndoc.save(\"vulnerable.pdf\");\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.0.\n\n### Workarounds\nEscape parentheses in user-provided JavaScript code before passing them to the `addJS` method.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","aliases":["CVE-2026-25755"],"modified":"2026-07-17T21:11:37.762999494Z","published":"2026-02-19T19:32:36Z","database_specific":{"github_reviewed_at":"2026-02-19T19:32:36Z","nvd_published_at":"2026-02-19T15:16:12Z","cwe_ids":["CWE-116","CWE-94"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25755"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437"},{"type":"WEB","url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md"},{"type":"PACKAGE","url":"https://github.com/parallax/jsPDF"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0"}],"affected":[{"package":{"name":"jspdf","ecosystem":"npm","purl":"pkg:npm/jspdf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9vjf-qc39-jprp/GHSA-9vjf-qc39-jprp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}