CVE-2026-25940
📋 TL;DR
This vulnerability in jsPDF allows attackers to inject arbitrary PDF objects, including JavaScript actions, through user-controlled properties in the Acroform module. When exploited, malicious JavaScript executes when a victim hovers over radio options in generated PDFs. Any application using jsPDF versions before 4.2.0 that accepts unsanitized user input for PDF generation is affected.
💻 Affected Systems
- jsPDF
📦 What is this software?
Jspdf by Parall
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user sessions through malicious JavaScript execution, leading to credential theft, session hijacking, or further exploitation of the victim's system.
Likely Case
Cross-site scripting (XSS) attacks where malicious JavaScript executes in the victim's browser context, potentially stealing sensitive data or performing unauthorized actions.
If Mitigated
Limited impact with proper input sanitization preventing injection of malicious PDF objects.
🎯 Exploit Status
Exploitation requires user interaction (hovering over radio options) but injection is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.0
Vendor Advisory: https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m
Restart Required: No
Instructions:
1. Update jsPDF dependency to version 4.2.0 or later. 2. Update package.json to specify 'jspdf': '^4.2.0'. 3. Run npm update or yarn upgrade. 4. Test PDF generation functionality.
🔧 Temporary Workarounds
Input Sanitization
allSanitize all user input before passing it to jsPDF Acroform properties and methods.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled data passed to jsPDF.
- Disable or restrict use of the Acroform module if not essential for functionality.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for jsPDF version. If version is below 4.2.0 and application uses Acroform with user input, it's vulnerable.Check Version:
npm list jspdf or check package.json for 'jspdf' versionVerify Fix Applied:
Verify jsPDF version is 4.2.0 or higher in package.json and test PDF generation with malicious input attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual PDF generation requests with suspicious input patterns
- JavaScript errors related to PDF parsing
Network Indicators:
- PDF files with embedded JavaScript in Acroform objects
- Unexpected network calls from PDF viewer contexts
SIEM Query:
source="web_server" AND (uri="*.pdf" OR content_type="application/pdf") AND (user_agent="*jspdf*" OR referrer="*jspdf*")