CVE-2026-22787
📋 TL;DR
html2pdf.js versions before 0.14.0 contain a cross-site scripting (XSS) vulnerability when processing text input. Attackers can inject malicious scripts that execute in users' browsers, potentially stealing sensitive data, hijacking sessions, or defacing websites. Any application using vulnerable versions of html2pdf.js with text input is affected.
💻 Affected Systems
- html2pdf.js
📦 What is this software?
Html2pdf.js by Ekoopmans
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user sessions, theft of sensitive data (credentials, personal information), website defacement, and potential malware distribution to visitors.
Likely Case
Session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users.
If Mitigated
Limited impact due to input validation, output encoding, or Content Security Policy preventing script execution.
🎯 Exploit Status
Exploitation requires user interaction (loading a malicious page) but is straightforward once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.14.0
Vendor Advisory: https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc
Restart Required: No
Instructions:
1. Update html2pdf.js dependency to version 0.14.0 or later. 2. For npm: 'npm update html2pdf.js'. 3. For direct inclusion: replace script file with patched version from GitHub releases.
🔧 Temporary Workarounds
Input Sanitization
allImplement strict input validation and sanitization for all text passed to html2pdf.js
Content Security Policy
allImplement strict CSP headers to prevent script execution from untrusted sources
🧯 If You Can't Patch
- Disable text input functionality in html2pdf.js and only use element sources
- Implement server-side validation and sanitization of all user input before passing to html2pdf.js
🔍 How to Verify
Check if Vulnerable:
Check package.json or script source for html2pdf.js version. If version is below 0.14.0 and text input is used, the system is vulnerable.Check Version:
npm list html2pdf.js (for npm) or check script tag src attribute for versionVerify Fix Applied:
Confirm html2pdf.js version is 0.14.0 or later. Test with known XSS payloads in text input to ensure scripts are not executed.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in html2pdf.js input parameters
- Multiple failed PDF generation attempts with suspicious input
Network Indicators:
- Requests to html2pdf.js endpoints with script-like content in parameters
SIEM Query:
source="web_server" AND (uri="*html2pdf*" OR uri="*pdf*" OR user_agent="*html2pdf*") AND (param="*<script>*" OR param="*javascript:*" OR param="*onerror=*" OR param="*onload=*")🔗 References
- https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b
- https://github.com/eKoopmans/html2pdf.js/issues/865
- https://github.com/eKoopmans/html2pdf.js/pull/877
- https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0
- https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc
- https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability/
