CVE-2026-31898: jsPDF has a PDF Object Injection via FreeText color
Impact
User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.
If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..
createAnnotation: color parameter
Example attack vector:
js import { jsPDF } from 'jspdf'
const doc = new jsPDF();
const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';
doc.createAnnotation({ type: 'freetext', bounds: { x: 10, y: 10, w: 120, h: 20 }, contents: 'hello', color: payload });
doc.save('test.pdf');
Patches
The vulnerability has been fixed in jsPDF@4.2.1.
Workarounds Sanitize user input before passing it to the vulnerable API members.
Other sources
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
— Red Hat
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jspdfto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
jsPDFto a version that resolves this vulnerability.Fixed in 4.2.1 - Configuration
Sanitize/validate user-supplied input before passing it to jsPDF.createAnnotation({ type: 'freetext', color }) to prevent PDF object injection (e.g., JavaScript actions) via the color parameter.
jsPDF (createAnnotation) color parameter input handling = sanitized
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31898?
CVE-2026-31898 is considered a high severity vulnerability due to the potential for arbitrary PDF object injection.
How do I fix CVE-2026-31898?
To fix CVE-2026-31898, upgrade to jsPDF version 4.2.1 or later.
What software is affected by CVE-2026-31898?
CVE-2026-31898 affects the jsPDF library versions up to and including 4.2.0.
What kind of attack can CVE-2026-31898 facilitate?
CVE-2026-31898 can facilitate attacks involving the injection of arbitrary JavaScript actions within PDF documents.
Can CVE-2026-31898 be exploited remotely?
Yes, CVE-2026-31898 can potentially be exploited remotely if a user can supply unvalidated input to the affected method.