CVE-2026-25755: jsPDF PDF Object Injection via Unsanitized Input in addJS Method
Summary
CVE-2026-25755: jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method. Affects jspdf versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsPDF is a popular JavaScript library used for generating PDF documents in web applications. It allows developers to create complex PDF files programmatically, offering features such as text, images, and vector graphics. However, jsPDF has a vulnerability that can be exploited through the addJS method, which allows the injection of arbitrary PDF objects if user input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from the lack of input sanitization in the addJS method of jsPDF. An attacker can control the argument passed to this method, enabling them to inject malicious JavaScript code into the generated PDF. This can lead to arbitrary code execution when the PDF is opened, potentially compromising the security of users who interact with the document. The technical aspect involves escaping the JavaScript string delimiter, allowing the attacker to manipulate the document structure and execute harmful actions.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.0
This is the first release that contains the fix.
npm install jspdf@4.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can escape parentheses in any user-provided JavaScript code before passing it to the addJS method. Here is an example of how to do this:
const safePayload = userInput.replace(/\(/g, '\\(').replace(/\)/g, '\\)');
doc.addJS(safePayload);
Conclusion
In summary, the jsPDF library has a significant vulnerability (CVE-2026-25755) that allows for PDF object injection through unsanitized input in the addJS method. It is crucial to update to version 4.2.0 or later to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary workaround.
See every vulnerability recorded for jspdf →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to arbitrary code execution, allowing attackers to manipulate the PDF document and execute malicious actions on users' systems.
Yes, you can implement a workaround by sanitizing user input to escape parentheses before passing it to the addJS method.
More details can be found in the official advisory on GitHub: https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
