CVE-2026-22787: html2pdf.js Cross-Site Scripting Vulnerability
Summary
CVE-2026-22787: html2pdf.js contains a cross-site scripting vulnerability. Affects html2pdf.js versions < 0.14.0. Fixed in 0.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
html2pdf.js is a popular JavaScript library that allows developers to convert HTML content into PDF documents. It is widely used for generating printable documents from web applications. The library provides a straightforward API for rendering HTML elements or text sources into PDF format. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack when handling text sources, which can lead to significant security risks.
Vulnerability Detail
html2pdf.js contains a cross-site scripting (XSS) vulnerability that arises when a text source is provided instead of an HTML element. The library does not adequately sanitize this text before it is added to the Document Object Model (DOM). As a result, malicious scripts can be executed in the client's browser, compromising the confidentiality, integrity, and availability of the page's data. An example of an attack vector is when a user inputs malicious HTML code, such as an image tag with an error handler that executes JavaScript to steal cookies.
How To Fix
Minimum fixed version
0.14.0
This is the first release that contains the fix.
npm install html2pdf.js@0.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users who cannot update to the patched version, it is crucial to manually sanitize any text input before using it as a source in html2pdf.js. You can use a library like DOMPurify to clean the input. Here is an example of how to sanitize the input:
import DOMPurify from 'dompurify';
const maliciousHTML = '<img src=x onerror="alert(document.cookie)">';
const safeHTML = DOMPurify.sanitize(maliciousHTML);
html2pdf(safeHTML);
Conclusion
The vulnerability identified as CVE-2026-22787 in html2pdf.js poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly encouraged to update to the latest version to mitigate this risk. For those unable to update, proper sanitization of input is essential to maintain security.
See every vulnerability recorded for html2pdf.js →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
This vulnerability can facilitate cross-site scripting (XSS) attacks, allowing attackers to execute malicious scripts in the user's browser.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
If you cannot update to the patched version, ensure that you manually sanitize any text input before using it as a source in html2pdf.js.
