Executive brief
html2pdf.js is a popular JavaScript library that converts HTML content to PDF documents. The library contains a cross-site scripting (XSS) vulnerability when processing text input, allowing malicious scripts embedded in HTML strings to execute in users' browsers. An attacker can exploit this to steal cookies, session tokens, or other sensitive data from affected web pages.
Technical details
The vulnerability is a reflected XSS (CWE-79) in html2pdf.js versions prior to 0.14.0. When the library receives text input rather than a DOM element, it fails to properly sanitize the HTML before attaching it to the DOM, allowing event handler attributes (e.g., onerror on img tags) to execute arbitrary JavaScript. The attack requires no authentication and has a low attack complexity; a victim need only view a page that calls html2pdf() with untrusted HTML content. The vulnerability enables full compromise of page confidentiality and integrity (session hijacking, credential theft, malware injection). The fix was released in version 0.14.0, which integrates DOMPurify to sanitize text sources before DOM insertion.
Affected products
- eKoopmans html2pdf.js < 0.14.0
Timeline
- 2026-01-14: disclosed
- 2026-01-14: patched: html2pdf.js version 0.14.0 released with DOMPurify integration