CVE-2026-25940
Arbitrary PDF Object Injection in jsPDF Acroform Module
Publication date: 2026-02-19
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parall | jspdf | to 4.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update jsPDF to version 4.2.0 or later where the issue is fixed.
As a workaround, sanitize all user input before passing it to the vulnerable Acroform module properties and methods to prevent injection of arbitrary PDF objects.
Can you explain this vulnerability to me?
This vulnerability exists in the jsPDF library prior to version 4.2.0, specifically in the Acroform module. It allows users to inject arbitrary PDF objects, including JavaScript actions, by controlling certain properties and methods without proper sanitization. When a victim interacts with a radio option in the PDF, the injected JavaScript actions can be executed.
The issue arises if unsanitized input is passed to vulnerable API members, enabling this injection. The vulnerability was fixed in jsPDF version 4.2.0.
How can this vulnerability impact me? :
This vulnerability can lead to the execution of arbitrary JavaScript code within a PDF document when a user interacts with certain form elements, such as radio buttons. This can be exploited to perform malicious actions like stealing sensitive information, executing unwanted scripts, or compromising the victim's system security.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know