Injection Vulnerability in jsPDF Library by Parallax

CVE-2026-31898

What is CVE-2026-31898?

The jsPDF library, used for generating PDF documents in JavaScript, has a vulnerability that allows users to inject arbitrary PDF objects through the unsanitized input of the createAnnotation method. This issue arises before version 4.2.1, where an attacker could exploit the color parameter in the method, potentially leading to JavaScript actions being executed upon opening or interacting with the PDF. Users are advised to sanitize their input to mitigate this risk, and they should upgrade to version 4.2.1 or later to ensure their systems are secure.

References