CVE-2026-31898 PUBLISHED

jsPDF has a PDF Object Injection via FreeText color

Assigner: GitHub_M
Reserved: 09.03.2026 Published: 18.03.2026 Updated: 18.03.2026

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 8.1

Product Status

Vendor parallax
Product jsPDF
Versions
  • Version < 4.2.1 is affected

References

Problem Types

  • CWE-116: Improper Encoding or Escaping of Output CWE