CVE-2026-24043: jsPDF Vulnerable to Stored XMP Metadata Injection
Summary
CVE-2026-24043: jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation). Affects jspdf versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsPDF is a popular open-source library used for generating PDF documents in web applications. It allows developers to create complex PDF files programmatically using JavaScript. The library is widely utilized due to its ease of use and extensive features, including text, images, and vector graphics support. However, a vulnerability has been identified that allows for the injection of arbitrary XML into the PDF metadata, potentially compromising the integrity of the documents.
Vulnerability Detail
The vulnerability arises from user control over the first argument of the addMetadata function in jsPDF. If unsanitized input is passed to this method, an attacker can inject malicious XMP metadata into the generated PDF. This could lead to spoofing of document authorship, as the attacker can manipulate the 'dc:creator' field to impersonate a trusted administrator. The ramifications include loss of document integrity, especially if the PDF is signed or processed further.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install jspdf@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, sanitize user input before passing it to the addMetadata method. Here is an example of how to escape XML entities in JavaScript:
let input = '...';
input = input .replace(/&/g, '&') .replace(/</g, '<') .replace(/>/g, '>') .replace(/"/g, '"') .replace(/'/g, ''');
doc.addMetadata(input);
Conclusion
The jsPDF library has a vulnerability that allows for the injection of malicious XML into PDF metadata, posing risks to document integrity and authorship spoofing. It is crucial to update to version 4.1.0 or later to mitigate this risk. If immediate updates are not possible, ensure to sanitize user inputs to prevent exploitation.
See every vulnerability recorded for jspdf →
FAQ
The vulnerability allows for the injection of arbitrary XML into the PDF metadata, which can lead to spoofing and integrity violations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your package-lock.json file to see if jsPDF is included.
The main risks include loss of document integrity and the potential for attackers to impersonate trusted users by spoofing metadata.
Yes, the vulnerability has been fixed in jsPDF version 4.1.0. Updating to this version will resolve the issue.
You should sanitize user input before passing it to the addMetadata method to mitigate the risk of injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
