parallax jsPDF up to 4.2.0 cross site scripting

Summaryinfo

A vulnerability was found in parallax jsPDF up to 4.2.0. It has been declared as problematic. This issue affects some unknown processing. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-31938. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in parallax jsPDF up to 4.2.0. It has been rated as problematic. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-31938 since 03/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 4.2.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 87a40bbd07e6b30575196370670b41f264aa78d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• parallax

Name

• jsPDF

Version

• 4.0
• 4.1
• 4.2.0

License

• open-source

Website

• Product: https://github.com/parallax/jsPDF/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion