CVE-2026-25940: jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
Impact
User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.
If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option.
AcroformChildClass.appearanceState
Example attack vector:
js import { jsPDF } from "jspdf" const doc = new jsPDF();
const group = new doc.AcroFormRadioButton(); group.x = 10; group.y = 10; group.width = 20; group.height = 10; doc.addField(group);
const child = group.createOption("opt1"); child.x = 10; child.y = 10; child.width = 20; child.height = 10; child.appearanceState = "Off /AA << /E << /S /JavaScript /JS (app.alert('XSS')) >> >>";
doc.save("test.pdf");
Patches
The vulnerability has been fixed in jsPDF@4.2.0.
Workarounds Sanitize user input before passing it to the vulnerable API members.
Other sources
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF.0. As a workaround, sanitize user input before passing it to the vulnerable API members.
— Red Hat
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jspdfto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
jsPDFto a version that resolves this vulnerability.Fixed in 4.2.0 - Configuration
Sanitize/validate any user input before assigning it to vulnerable AcroForm module properties/methods (including AcroformChildClass.appearanceState and other user-controlled AcroForm radio option properties) to prevent injection of arbitrary PDF objects (e.g., JavaScript actions).
jsPDF AcroForm (AcroFormRadioButton / RadioButton.createOption / AcroformChildClass.appearanceState) user-supplied inputs to AcroformChildClass.appearanceState (and related properties/methods that can be set by user) = sanitized before use
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25940?
The severity of CVE-2026-25940 is considered high due to the potential for arbitrary code injection in PDF documents.
How do I fix CVE-2026-25940?
To fix CVE-2026-25940, update jsPDF to version 4.2.0 or later which addresses the vulnerability.
What does CVE-2026-25940 affect?
CVE-2026-25940 affects versions of jsPDF prior to 4.2.0 used for generating PDFs in JavaScript.
What types of attacks can be executed due to CVE-2026-25940?
CVE-2026-25940 allows attackers to inject arbitrary PDF objects, such as malicious JavaScript actions, which can lead to data theft or further exploitation.
Who is affected by CVE-2026-25940?
Developers using versions of jsPDF below 4.2.0 in their web applications are potentially affected by CVE-2026-25940.