CVE-2026-31938
HTML Injection in jsPDF Output Function Allows Script Execution
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parall | jspdf | to 4.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-31938 is a critical HTML Injection vulnerability in the jsPDF JavaScript library versions up to 4.2.0. It arises because user-controlled input passed to the output() function's options argument is not properly sanitized. This allows attackers to inject arbitrary HTML and scripts into the browser context where the generated PDF is opened."}, {'type': 'paragraph', 'content': 'The vulnerability can be exploited when an attacker supplies malicious values for output options (such as filenames or URLs) through a web interface. When a victim creates and opens a PDF using one of the vulnerable output method overloads in their browser, the injected scripts execute in the victim’s browser context.'}, {'type': 'paragraph', 'content': 'This can lead to theft or modification of sensitive data accessible in that browser context. The issue has been fixed in jsPDF version 4.2.1 by properly sanitizing inputs and improving how PDFs are rendered in new windows.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary scripts in your browser context when you open a PDF generated by a vulnerable jsPDF version. This can lead to:
- Theft of sensitive information accessible in the browser context.
- Modification of secrets or data within the browser session.
- Potential compromise of confidentiality and integrity of your data.
The attack requires no special privileges but does require user interaction (opening the malicious PDF). The vulnerability has a high impact on confidentiality and integrity, with a low impact on availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "Detection of this vulnerability involves identifying usage of vulnerable jsPDF versions (up to 4.2.0) that accept unsanitized user input in the output() function's options argument, especially when using output method overloads such as pdfobjectnewwindow, pdfjsnewwindow, or dataurlnewwindow."}, {'type': 'paragraph', 'content': 'You can scan your project dependencies to check if jsPDF is used and its version is below 4.2.1.'}, {'type': 'list_item', 'content': 'Use npm or yarn to list installed versions: `npm list jspdf` or `yarn list jspdf`'}, {'type': 'list_item', 'content': "Search your codebase for usage of the output() function with options argument, especially looking for calls like `doc.output('pdfjsnewwindow', {...})` or similar."}, {'type': 'paragraph', 'content': 'Additionally, monitor network traffic or logs for suspicious PDF generation requests that include user-controlled parameters passed to jsPDF output options.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade jsPDF to version 4.2.1 or later, where this vulnerability has been fixed.'}, {'type': 'paragraph', 'content': "As an immediate workaround, sanitize all user inputs before passing them to the output() function's options argument to prevent injection of arbitrary HTML or scripts."}, {'type': 'list_item', 'content': 'Upgrade jsPDF to version 4.2.1 or newer.'}, {'type': 'list_item', 'content': 'Implement input validation and sanitization on all user-controlled data used in PDF generation options.'}, {'type': 'list_item', 'content': 'Avoid using vulnerable output method overloads with untrusted input.'}] [1]