# CVE-2026-24043: jsPDF XML injection in addMetadata function

Source: https://junglewise.ai/threats/cve-2026-24043-jspdf-xml-injection-in-addmetadata-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-24043 · Severity: medium · CVSS 4 · Published 2026-02-02

jsPDF is a JavaScript library used to generate PDF documents in web applications. An attacker who can supply unsanitized input to the addMetadata() function can inject malicious XML metadata into generated PDFs, allowing them to forge the document's author field or other metadata to impersonate trusted sources. This undermines the integrity and authenticity of electronically signed or archived PDFs.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-24043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24043 being exploited in the wild.

**How severe is CVE-2026-24043?** Medium severity, with a CVSS score of 4, published 2 February 2026.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.

**Is there a fix for CVE-2026-24043?** Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24043 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24043?** Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 4.1.0 or later

  ```sh
  npm install jspdf@4.1.0
  ```


## Technical details

This is a stored XMP metadata injection vulnerability (CWE-20, CWE-74) in jsPDF's addMetadata() function. The vulnerability occurs because user-supplied input passed to addMetadata() is not sanitized before being embedded into the PDF's XMP metadata stream. An attacker can inject XML tags to break out of the current metadata structure and inject arbitrary XML, such as forged author or creator fields. The attack requires network access and the ability to pass unsanitized user input to the addMetadata() method, but requires no authentication or user interaction. Successful exploitation allows integrity violation of signed PDFs and document spoofing. The vulnerability was fixed in jsPDF version 4.1.0; all versions 4.0.0 and earlier are affected.

## Affected products

- parallax jsPDF <=4.0.0

## Identifiers

- CVE-2026-24043
- GHSA-vm32-vv63-w422

## Timeline

- 2026-02-02: disclosed
- 2026-02-02: patched: Fixed in jsPDF 4.1.0

## References

- [https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422](https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422)

## Related threats

- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)
- [parallax jsPDF PDF injection in Acroform module](https://junglewise.ai/threats/cve-2026-25940-parallax-jspdf-pdf-injection-in-acroform-module)
- [parallax jsPDF PDF object injection in addJS method](https://junglewise.ai/threats/cve-2026-25755-parallax-jspdf-pdf-object-injection-in-addjs-method)
- [parallax jsPDF denial of service in addImage method](https://junglewise.ai/threats/cve-2026-25535-parallax-jspdf-denial-of-service-in-addimage-method)