CVE-2020-7690: Cross-site scripting in jspdf
Summary
CVE-2020-7690: Cross-site scripting in jspdf. Affects jspdf versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The jspdf package is an open-source library for generating PDF files in JavaScript. It provides a simple and convenient way to create PDF documents programmatically. However, a vulnerability has been discovered in jspdf that allows for cross-site scripting (XSS) attacks. This means that an attacker can inject malicious JavaScript code into the generated PDF, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in jspdf arises from the html method, which is used to insert HTML content into the PDF document. Due to insufficient input sanitization, it is possible for an attacker to inject JavaScript code through this method. When the PDF is opened and rendered, the injected code will be executed within the context of the user's browser, allowing the attacker to manipulate the page, steal sensitive information, or perform other malicious actions. This vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install jspdf@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of jspdf is not immediately feasible, a temporary workaround is to manually sanitize any HTML content before passing it to the html method. This can be done using a library or function that properly escapes or removes any potentially malicious JavaScript code. Here is an example of how to sanitize HTML content using the DOMPurify library:
const DOMPurify = require('dompurify');
const sanitizedHtml = DOMPurify.sanitize(htmlContent);
// Pass the sanitized HTML to jspdf
pdf.html(sanitizedHtml);
Conclusion
In conclusion, the jspdf package is vulnerable to cross-site scripting (XSS) attacks due to insufficient input sanitization in the html method. To mitigate this vulnerability, it is crucial to upgrade to jspdf version 2.0.0 or later. Alternatively, you can manually sanitize HTML content before using it with jspdf. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jspdf →
FAQ
jspdf is an open-source JavaScript library for generating PDF files programmatically.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability in jspdf allows attackers to execute arbitrary JavaScript code within the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to jspdf version 2.0.0 or later.
Yes, a temporary workaround is to manually sanitize any HTML content before passing it to the html method in jspdf.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
