Is CVE-2026-24043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24043 being exploited in the wild.

How severe is CVE-2026-24043?

Medium severity, with a CVSS score of 4, published 2 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.

Is there a fix for CVE-2026-24043?

Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24043 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24043?

Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24043: jsPDF XML injection in addMetadata function

CVE-2026-24043 · Severity: medium · CVSS 4 · Published 2026-02-02

jsPDF is a JavaScript library used to generate PDF documents in web applications. An attacker who can supply unsanitized input to the addMetadata() function can inject malicious XML metadata into generated PDFs, allowing them to forge the document's author field or other metadata to impersonate trusted sources. This undermines the integrity and authenticity of electronically signed or archived PDFs.

Technologies: jspdf (npm). Vendors: npm.

Quick answers

Is CVE-2026-24043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24043 being exploited in the wild.
How severe is CVE-2026-24043?: Medium severity, with a CVSS score of 4, published 2 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2026-24043?: Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24043 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24043?: Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.1.0 or later
```
npm install jspdf@4.1.0
```

Technical details

This is a stored XMP metadata injection vulnerability (CWE-20, CWE-74) in jsPDF's addMetadata() function. The vulnerability occurs because user-supplied input passed to addMetadata() is not sanitized before being embedded into the PDF's XMP metadata stream. An attacker can inject XML tags to break out of the current metadata structure and inject arbitrary XML, such as forged author or creator fields. The attack requires network access and the ability to pass unsanitized user input to the addMetadata() method, but requires no authentication or user interaction. Successful exploitation allows integrity violation of signed PDFs and document spoofing. The vulnerability was fixed in jsPDF version 4.1.0; all versions 4.0.0 and earlier are affected.

Affected products

parallax jsPDF <=4.0.0

Identifiers

CVE-2026-24043
GHSA-vm32-vv63-w422

Timeline

2026-02-02: disclosed
2026-02-02: patched: Fixed in jsPDF 4.1.0

References

https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.