CVE-2026-24737

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24737

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24737.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24737

Aliases

GHSA-pqxr-3g65-p328

Related

CGA-3xmq-5c8m-c6hc

Published

2026-02-02T20:29:05.011Z

Modified

2026-03-13T04:10:19.583763Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

Details

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24737.json"
}

References

Affected packages

Git / github.com/mrrio/jspdf

Affected ranges

Type

GIT

Repo

https://github.com/mrrio/jspdf

Events

Introduced

Fixed

02273814bf0222eda02944f9a14128811f3b5a33

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.0"
        }
    ]
}

Affected versions

1.*

1.1.135

1.3.4

v.*

v.1.4.0

v0.*

v0.9.0

v1.*

v1.0.106

v1.0.115

v1.0.116

v1.0.119

v1.0.138

v1.0.150

v1.0.178

v1.0.272

v1.2.60

v1.2.61

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.4.0

v1.4.1

v1.5.0

v1.5.1

v1.5.2

v1.5.3

Other

v2,1,0

v2.*

v2.0.0

v2.1.1

v2.2.0

v2.3.0

v2.3.1

v2.4.0

v2.5.0

v2.5.1

v2.5.2

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

v4.*

v4.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24737.json"

Git / github.com/parallax/jspdf