{"id":"GHSA-cjw8-79x6-5cj4","summary":"jsPDF has Shared State Race Condition in addJS Plugin","details":"### Impact\n\nThe addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.\n\nIf multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B.\n\nTypically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side.\n\n```js\nimport { jsPDF } from \"jspdf\";\n\nconst docA = new jsPDF();\nconst docB = new jsPDF();\n\n// 1. User A sets their script (stored in shared 'text' variable)\ndocA.addJS('console.log(\"Secret A\");');\n\n// 2. User B sets their script (overwrites shared 'text' variable)\ndocB.addJS('console.log(\"Secret B\");');\n\n// 3. User A saves their PDF (reads current 'text' variable)\ndocA.save(\"userA.pdf\");\n\n// Result: userA.pdf contains \"Secret B\" instead of \"Secret A\"\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.0.1. The fix moves the shared variable into the function scope, ensuring isolation between instances.\n\n### Workarounds\nAvoid using the addJS method in concurrent server-side environments. If usage is required, ensure requests are processed sequentially (e.g., using a queue) rather than in parallel.","aliases":["CVE-2026-24040"],"modified":"2026-07-17T21:11:45.058568841Z","published":"2026-02-02T18:20:02Z","database_specific":{"github_reviewed_at":"2026-02-02T18:20:02Z","nvd_published_at":"2026-02-02T23:16:07Z","cwe_ids":["CWE-200","CWE-362"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24040"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e"},{"type":"PACKAGE","url":"https://github.com/parallax/jsPDF"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/releases/tag/v4.1.0"}],"affected":[{"package":{"name":"jspdf","ecosystem":"npm","purl":"pkg:npm/jspdf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cjw8-79x6-5cj4/GHSA-cjw8-79x6-5cj4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}