Arbitrary JavaScript Execution Vulnerability in jsPDF AcroFormChoiceField
Summary
GHSA-pqxr-3g65-p328: jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution. Affects jspdf versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jsPDF is a popular open-source library used for generating PDF documents in web applications. It allows developers to create complex PDF files programmatically, including features like text, images, and forms. The library includes an AcroForm module that enables the creation of interactive PDF forms. However, a vulnerability in this module allows for the injection of arbitrary JavaScript, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from user control over properties and methods of the Acroform module, specifically in the AcroFormChoiceField. This allows attackers to inject arbitrary PDF objects, including JavaScript actions, which are executed when the victim opens the document. The affected API members include AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. An example attack vector demonstrates how an attacker can craft a payload that executes JavaScript when the PDF is opened, leading to potential data theft or other malicious actions.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install jspdf@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Sanitize user input before passing it to the vulnerable API members. This can be done by implementing input validation and escaping any potentially harmful characters. Here is an example of how to sanitize input in JavaScript:
function sanitizeInput(input) {
return input.replace(/[\[\]{}()<>]/g, '');
}
const safeInput = sanitizeInput(userInput);
choiceField.addOption(safeInput);
Conclusion
The jsPDF library has a critical vulnerability in its AcroFormChoiceField that allows for arbitrary JavaScript execution through unsanitized user input. It is essential for developers using this library to update to version 4.1.0 or later and implement input sanitization to protect against potential attacks.
See every vulnerability recorded for jspdf →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Versions of jsPDF up to and including 4.0.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
If exploited, this vulnerability can lead to arbitrary JavaScript execution, which may result in data theft, unauthorized actions, or other malicious activities when the PDF is opened by a user.
Yes, the vulnerability has been fixed in jsPDF version 4.1.0. It is recommended to update to this version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
