CVE-2026-31938: jsPDF HTML Injection Vulnerability in New Window Paths

Background

jsPDF is a popular open-source library used for generating PDF documents in web applications. It allows developers to create PDFs directly in the browser using JavaScript. The library offers various functionalities, including text, images, and shapes rendering, and supports multiple output formats. However, a critical vulnerability has been identified in certain output methods that can lead to HTML injection, posing significant security risks to users.

Vulnerability Detail

The vulnerability arises from user control over the 'options' argument of the 'output' function in jsPDF. Attackers can inject arbitrary HTML, including scripts, into the browser context where the generated PDF is opened. This is particularly concerning for the overloads 'pdfobjectnewwindow', 'pdfjsnewwindow', and 'dataurlnewwindow', where unsanitized user input can be exploited. By providing malicious values through a web interface, attackers can craft a scenario where victims unknowingly execute harmful scripts in their browsers, potentially leading to data theft or unauthorized actions.

npm install jspdf@4.2.1

Workaround

As a temporary measure, sanitize all user inputs before passing them to the output method. For example, you can use a function to escape potentially harmful characters in the input:

function sanitizeInput(input) {
  return input.replace(/</g, '&lt;').replace(/>/g, '&gt;');
}

const safeFilename = sanitizeInput(userProvidedFilename);

doc.output('pdfjsnewwindow', {
  filename: safeFilename,
  pdfJsUrl: 'viewer.html'
});

Conclusion

The jsPDF library has a critical vulnerability that allows for HTML injection through certain output methods. It is essential to update to the patched version 4.2.1 to mitigate the risks associated with this vulnerability. Additionally, implementing input sanitization can serve as a temporary measure until the update is applied.

See every vulnerability recorded for jspdf →

FAQ