CVE-2026-31898: jsPDF has a PDF Object Injection via FreeText color

Published Mar 17, 2026
·
Updated

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

createAnnotation: color parameter

Example attack vector:

js import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({ type: 'freetext', bounds: { x: 10, y: 10, w: 120, h: 20 }, contents: 'hello', color: payload });

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds Sanitize user input before passing it to the vulnerable API members.

Other sources

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF.1. As a workaround, sanitize user input before passing it to the vulnerable API members.

Red Hat

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.

NVD

Affected Software

2 affected componentsFixes available
npm/jspdf<=4.2.0
4.2.1
parall jspdf Node.js<4.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/jspdf to a version that resolves this vulnerability.

    Fixed in 4.2.1
  2. Upgrade

    Upgrade jsPDF to a version that resolves this vulnerability.

    Fixed in 4.2.1
  3. Configuration

    Sanitize/validate user-supplied input before passing it to jsPDF.createAnnotation({ type: 'freetext', color }) to prevent PDF object injection (e.g., JavaScript actions) via the color parameter.

    jsPDF (createAnnotation) color parameter input handling = sanitized

Event History

Mar 17, 2026
Advisory Published
via GitHub·05:07 PM
Data Sourced
via GitHub·05:07 PM
DescriptionSeverityWeaknessAffected Software
Mar 18, 2026
CVE Published
via MITRE·03:03 AM
Data Sourced
via MITRE·03:03 AM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·04:04 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
RemedyAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-31898?

CVE-2026-31898 is considered a high severity vulnerability due to the potential for arbitrary PDF object injection.

2

How do I fix CVE-2026-31898?

To fix CVE-2026-31898, upgrade to jsPDF version 4.2.1 or later.

3

What software is affected by CVE-2026-31898?

CVE-2026-31898 affects the jsPDF library versions up to and including 4.2.0.

4

What kind of attack can CVE-2026-31898 facilitate?

CVE-2026-31898 can facilitate attacks involving the injection of arbitrary JavaScript actions within PDF documents.

5

Can CVE-2026-31898 be exploited remotely?

Yes, CVE-2026-31898 can potentially be exploited remotely if a user can supply unvalidated input to the affected method.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203