CVE-2026-31898: jsPDF Arbitrary PDF Object Injection via FreeText Color

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

jsPDF is a popular open-source library used for generating PDF documents in web applications. It allows developers to create complex PDF files programmatically, offering features such as text, images, and annotations. However, a vulnerability exists in the library that permits users to inject arbitrary PDF objects, potentially leading to security risks when the generated PDF is opened or interacted with.

Vulnerability Detail

The vulnerability arises from the user-controlled arguments in the 'createAnnotation' method of jsPDF, specifically the 'color' parameter. This flaw allows an attacker to inject malicious PDF objects, including JavaScript actions, which could execute when the PDF is opened. For instance, an attacker could craft a payload that executes a command on the user's system, posing significant security threats.

npm install jspdf@4.2.1

Workaround

As a temporary measure, sanitize all user inputs before passing them to the 'createAnnotation' method. For example, you can implement a function to validate and clean the 'color' parameter to prevent injection of malicious content. Here is a simple example of sanitization:

function sanitizeColor(input) {
  // Allow only hexadecimal color codes
  const regex = /^#[0-9A-F]{6}$/i;
  return regex.test(input) ? input : '#000000'; // Default to black if invalid
}

const safeColor = sanitizeColor(userInput);

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',

color: safeColor

});

Conclusion

In summary, the jsPDF library has a critical vulnerability that allows for arbitrary PDF object injection through unsanitized user input. It is essential to update to the patched version and implement input sanitization to protect against potential exploits.

See every vulnerability recorded for jspdf →

FAQ