High · published February 3, 2026
⚡ A sneaky flaw in jsPDF could turn your PDFs into hidden traps! Users can inject JavaScript that runs automatically when unsuspecting victims open the document. 🔥 Think of it like a restaurant that allows customers to add their own secret ingredients to a dish without checking. If someone adds a dangerous spice, the unsuspecting diner could end up with a meal that has unexpected consequences! An attacker could craft a seemingly innocent PDF that runs malicious actions upon opening, leading to data theft or other harmful behaviors. The potential for this vulnerability is absolutely devastating, as it puts users' systems at risk right when they think they're dealing with a safe document.
Think of it like a restaurant that allows customers to add their own secret ingredients to a dish without checking. If someone adds a dangerous spice, the unsuspecting diner could end up with a meal that has unexpected consequences! The vulnerability in jsPDF allows for arbitrary PDF object injection through specific methods and properties of the Acroform module, namely AcroformChoiceField.addOption and others. This means unsanitized user input can execute unwanted JavaScript actions when the PDF is opened.
An attacker could craft a seemingly innocent PDF that runs malicious actions upon opening, leading to data theft or other harmful behaviors. The potential for this vulnerability is absolutely devastating, as it puts users' systems at risk right when they think they're dealing with a safe document. Update jsPDF to version 4.1.0 or later immediately to mitigate this risk. Ensure to validate all user input that could be passed to the vulnerable methods before processing. Regularly review your PDF generation logic for any potential vulnerabilities. You can tackle this issue with a quick update and vigilant input validation! You've got this! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| parall/jspdf | < 4.1.0 | 4.1.0 |