CVE-2026-31938: jsPDF has HTML Injection in New Window paths
Impact
User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:
"pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string. "pdfjsnewwindow": the pdfJsUrl and filename options "dataurlnewwindow": the filename option
The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.
Example attack vector:
js import { jsPDF } from 'jspdf'; const doc = new jsPDF();
const payload = 'x\"></iframe><script>window.n=1</script><iframe src="';
doc.output('pdfjsnewwindow', { filename: payload, pdfJsUrl: 'viewer.html' });
Patches The vulnerability has been fixed in jspdf@4.2.1.
Workarounds Sanitize user input before passing it to the output method.
Other sources
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf.1. As a workaround, sanitize user input before passing it to the output method.
— Red Hat
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jspdfto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
jspdfto a version that resolves this vulnerability.Fixed in 1 - Upgrade
Upgrade
jspdfto a version that resolves this vulnerability.Fixed in 4.2.1 - Configuration
As a workaround, sanitize any user-controlled values before passing them to jsPDF's output() method, specifically the options used by the 'dataurlnewwindow' filename option, the 'pdfjsnewwindow' pdfJsUrl and filename options, and the 'pdfobjectnewwindow' pdfObjectUrl option (and the entire JSON-serialized options object).
jsPDF output() (PDF new window paths: dataurlnewwindow/pdfjsnewwindow/pdfobjectnewwindow) options.filename / options.pdfJsUrl / options.pdfObjectUrl = sanitized user input only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31938?
CVE-2026-31938 is considered a high-severity vulnerability due to the potential for HTML injection leading to arbitrary script execution.
How do I fix CVE-2026-31938?
To mitigate CVE-2026-31938, upgrade jsPDF to version 4.2.1 or later.
What versions of jsPDF are affected by CVE-2026-31938?
CVE-2026-31938 affects jsPDF versions up to and including 4.2.0.
What type of attack is associated with CVE-2026-31938?
CVE-2026-31938 allows attackers to perform HTML injection attacks through user-controlled input.
What is the impact of CVE-2026-31938 on users?
The impact of CVE-2026-31938 includes potential unauthorized script execution in the user's browser when a PDF is opened.