CVE-2026-24737: jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
Impact
User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.
If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are:
AcroformChoiceField.addOption AcroformChoiceField.setOptions AcroFormCheckBox.appearanceState AcroFormRadioButton.appearanceState
Example attack vector:
js import { jsPDF } from "jspdf" const doc = new jsPDF();
var choiceField = new doc.AcroFormChoiceField(); choiceField.T = "VulnerableField"; choiceField.x = 20; choiceField.y = 20; choiceField.width = 100; choiceField.height = 20;
// PAYLOAD: // 1. Starts with "/" to bypass escaping. // 2. "dummy]" closes the array. // 3. "/AA" injects an Additional Action (Focus event). // 4. "/JS" executes arbitrary JavaScript. const payload = "/dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage [";
choiceField.addOption(payload); doc.addField(choiceField);
doc.save("test.pdf");
Patches
The vulnerability has been fixed in jsPDF@4.1.0.
Workarounds Sanitize user input before passing it to the vulnerable API members.
Credits Research and fix: Ahmet Artuç
Other sources
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF.0.
— Red Hat
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jspdfto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
jsPDFto a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Sanitize any user-controlled value before passing it to jsPDF AcroFormChoiceField.addOption. Ensure input does not start with '/' (since '/' can bypass escaping) to prevent PDF object/JavaScript injection.
AcroFormChoiceField.addOption input_sanitization = sanitize user input before passing it to AcroformChoiceField.addOption; do not allow input starting with '/' to bypass escaping - Configuration
Sanitize any user-controlled options before passing them to jsPDF AcroFormChoiceField.setOptions. Ensure input does not start with '/' (since '/' can bypass escaping) to prevent PDF object/JavaScript injection.
AcroFormChoiceField.setOptions input_sanitization = sanitize user input before passing it to AcroformChoiceField.setOptions; do not allow input starting with '/' to bypass escaping - Configuration
Sanitize any user-controlled value assigned to jsPDF AcroFormCheckBox.appearanceState. Ensure input does not start with '/' (since '/' can bypass escaping) to prevent PDF object/JavaScript injection.
AcroFormCheckBox.appearanceState input_sanitization = sanitize user input before passing it to AcroformCheckBox.appearanceState; do not allow input starting with '/' to bypass escaping - Configuration
Sanitize any user-controlled value assigned to jsPDF AcroFormRadioButton.appearanceState. Ensure input does not start with '/' (since '/' can bypass escaping) to prevent PDF object/JavaScript injection.
AcroFormRadioButton.appearanceState input_sanitization = sanitize user input before passing it to AcroformRadioButton.appearanceState; do not allow input starting with '/' to bypass escaping
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24737?
CVE-2026-24737 is considered to have a high severity due to the potential for arbitrary PDF object injection.
How do I fix CVE-2026-24737?
To fix CVE-2026-24737, upgrade to jspdf version 4.1.0 or later.
What software is affected by CVE-2026-24737?
CVE-2026-24737 affects jspdf versions up to 4.0.0 from npm.
What type of attacks can CVE-2026-24737 enable?
CVE-2026-24737 can enable attacks that inject malicious JavaScript actions into PDFs.
Can CVE-2026-24737 be exploited remotely?
Yes, CVE-2026-24737 can potentially be exploited remotely if an attacker can manipulate unsanitized input.