Is CVE-2020-7691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7691 being exploited in the wild.

How severe is CVE-2020-7691?

Low severity, with a CVSS score of 3.1, published 11 May 2021.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2020-7691?

Yes. jspdf (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-7691?

Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7691: Parallax jsPDF cross-site scripting via regex bypass

CVE-2020-7691 · Severity: low · CVSS 3.1 · Published 2021-05-11

jsPDF is a popular JavaScript library used by developers to generate PDF documents directly in web browsers. A security flaw allows attackers to bypass safety filters and execute malicious scripts when the library processes specially crafted HTML content. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious websites.

Technologies: jspdf (npm). Vendors: npm.

Quick answers

Is CVE-2020-7691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7691 being exploited in the wild.
How severe is CVE-2020-7691?: Low severity, with a CVSS score of 3.1, published 11 May 2021.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2020-7691?: Yes. jspdf (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-7691?: Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 2.0.0 or later
```
npm install jspdf@2.0.0
```

Technical details

A cross-site scripting (XSS) vulnerability exists in jsPDF due to an inadequate regular expression used for sanitizing HTML input, specifically within the fromHTML functionality. Attackers can bypass the filter by using nested or malformed script tags (e.g., <<script>script>). When the library processes this input, the outer tags are stripped but the inner malicious script remains and is executed in the context of the user's browser. This is a client-side XSS that requires user interaction, such as viewing a page that triggers the PDF generation from untrusted input. The issue was addressed by updating the underlying DOMPurify dependency to version 2.2.0 or higher.

Affected products

Parallax jspdf < 2.0.0

Identifiers

CVE-2020-7691
GHSA-3q6f-8grx-pr4v

Timeline

2020-05-06: disclosed: Vulnerability disclosed by Snyk Security Team
2020-07-06: advisory: NVD published CVE-2020-7691
2021-05-11: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.