Executive brief
jsPDF is a popular JavaScript library used to generate PDF documents in web applications. A cross-site scripting (XSS) vulnerability in the html method allows an attacker to inject malicious JavaScript code that executes in the victim's browser, potentially leading to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the html method of jsPDF, which fails to properly sanitize or escape user-supplied input before rendering it in the PDF. An attacker can inject arbitrary JavaScript code via the html method parameter. The attack requires user interaction (the user must process the malicious PDF or trigger the vulnerable code path) and network access to deliver the payload. Affected versions prior to 2.0.0 are vulnerable; the issue has been fixed in version 2.0.0 and later.
Affected products
- jsPDF jsPDF < 2.0.0
Timeline
- 2020-07-06: disclosed
- 2020: patched: Fixed in version 2.0.0
- 2021-05-17: advisory