CVE-2026-25940: jsPDF Arbitrary JavaScript Execution via PDF Injection in AcroForm Module
Summary
CVE-2026-25940: Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. Affects jspdf versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsPDF is a popular JavaScript library used for generating PDF documents in web applications. It allows developers to create complex PDF files directly from client-side code, offering features such as text, images, and vector graphics. However, a vulnerability in its AcroForm module has been identified, which permits users to inject arbitrary JavaScript into PDF documents, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from user control over properties and methods of the Acroform module, specifically through the 'appearanceState' property of radio button options. Unsanitized input can be used to inject arbitrary PDF objects, including JavaScript actions that execute when a victim interacts with the PDF. This could lead to malicious actions being performed without the user's consent, such as data theft or unauthorized access.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
npm install jspdf@4.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, sanitize any user input before passing it to the vulnerable API members. For example, you can implement a function to remove or escape potentially harmful characters from the input string before assigning it to 'appearanceState'.
Conclusion
The jsPDF library has a significant vulnerability (CVE-2026-25940) that allows for arbitrary JavaScript execution through PDF injection. It is crucial for developers using this library to update to version 4.2.0 or later to protect their applications from potential security threats. Additionally, implementing input sanitization can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for jspdf →
FAQ
jsPDF is a JavaScript library that allows developers to generate PDF documents directly in web applications.
This vulnerability allows for arbitrary JavaScript execution through PDF injection in the AcroForm module of jsPDF.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If an immediate update is not possible, ensure to sanitize user inputs before they are passed to the vulnerable API members to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
