Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Mar 18, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-31938 · Other software · parallax · reported by GitHubCritical 9.6
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-31898 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25940 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25755 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25535 · Other software · parallax · reported by GitHubHigh 8.7
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-24737 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-24133 · Other software · parallax · reported by GitHubHigh 8.7
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in jsPDF@4.1.0.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-24043 · Other software · parallax · reported by GitHubMedium 6.9
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-24040 · Other software · parallax · reported by GitHubMedium 6.3
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2025-68428 · Other software · parallax · reported by GitHubCritical 9.2
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025jsPDF is a library to generate PDFs in JavaScript.CVE-2025-57810 · Other software · parallax · reported by GitHubHigh 8.7
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025jsPDF is a library to generate PDFs in JavaScript.CVE-2025-29907 · Other software · parallax · reported by GitHubHigh 8.7
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2021This affects the package jspdf before 2.3.1.CVE-2021-23353 · Other software · Parall · reported by report@snyk.ioMedium 5.9
This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
- Product
- Jspdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2020In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.CVE-2020-7691 · Other software · Parall · reported by report@snyk.ioMedium 6.3
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
- Product
- Jspdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2020All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).CVE-2020-7690 · Other software · Parall · reported by report@snyk.ioMedium 6.1
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
- Product
- Jspdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.