CVE-2026-25940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25940
Aliases
Related
Published
2026-02-19T15:26:57.645Z
Modified
2026-02-25T08:12:52.194409Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
Details

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.

Database specific 
{
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25940.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/parallax/jspdf

Affected ranges

Type
GIT
Repo
https://github.com/parallax/jspdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7af912cadaf0f9a2ad28afe7af53033a2c61de64

Affected versions

1.*
1.1.135
1.3.4
v.*
v.1.4.0
v0.*
v0.9.0
v1.*
v1.0.106
v1.0.115
v1.0.116
v1.0.119
v1.0.138
v1.0.150
v1.0.178
v1.0.272
v1.2.60
v1.2.61
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
Other
v2,1,0
v2.*
v2.0.0
v2.1.1
v2.2.0
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.5.1
v2.5.2
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v4.*
v4.0.0
v4.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25940.json"