Junglewise Threat Intelligence

CVE-2026-22787: html2pdf.js cross-site scripting in text source handling

CVE-2026-22787 · Severity: medium · CVSS 4 · Published 2026-01-14

Vendors: npm.

Executive brief

html2pdf.js is a popular JavaScript library that converts HTML content to PDF documents. The library contains a cross-site scripting (XSS) vulnerability when processing text input, allowing malicious scripts embedded in HTML strings to execute in users' browsers. An attacker can exploit this to steal cookies, session tokens, or other sensitive data from affected web pages.

Technical details

The vulnerability is a reflected XSS (CWE-79) in html2pdf.js versions prior to 0.14.0. When the library receives text input rather than a DOM element, it fails to properly sanitize the HTML before attaching it to the DOM, allowing event handler attributes (e.g., onerror on img tags) to execute arbitrary JavaScript. The attack requires no authentication and has a low attack complexity; a victim need only view a page that calls html2pdf() with untrusted HTML content. The vulnerability enables full compromise of page confidentiality and integrity (session hijacking, credential theft, malware injection). The fix was released in version 0.14.0, which integrates DOMPurify to sanitize text sources before DOM insertion.

Affected products

  • eKoopmans html2pdf.js < 0.14.0

Timeline

  • 2026-01-14: disclosed
  • 2026-01-14: patched: html2pdf.js version 0.14.0 released with DOMPurify integration

References