Arbitrary Code Injection in jsPDF Library by Parallax

CVE-2026-25940

What is CVE-2026-25940?

The jsPDF library, widely used for generating PDFs in JavaScript, has a significant vulnerability prior to version 4.2.0. This issue arises from inadequate control over the properties and methods of the Acroform module, allowing malicious users to inject arbitrary PDF objects, including JavaScript actions, which execute upon user interaction, such as hovering over a radio button. While the vulnerability has been addressed in version 4.2.0, it is crucial for developers to sanitize user inputs rigorously to prevent exploitation through untrusted data.

References