Is CVE-2026-24737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24737 being exploited in the wild.

How severe is CVE-2026-24737?

High severity, with a CVSS score of 8.1, published 2 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.1.0; Red Hat Advanced Cluster Security for Kubernetes 4.8.9.

Is there a fix for CVE-2026-24737?

Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24737 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24737?

Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24737: parallax jsPDF PDF injection in Acroform module

CVE-2026-24737 · Severity: high · CVSS 8.1 · Published 2026-02-02

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A vulnerability in its form-handling module allows attackers to create malicious PDF files that execute unauthorized code when opened by a user. This could lead to the theft of sensitive information or unauthorized actions being performed on the victim's behalf.

Technologies: jspdf (npm), Red Hat Advanced Cluster Security for Kubernetes. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-24737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24737 being exploited in the wild.
How severe is CVE-2026-24737?: High severity, with a CVSS score of 8.1, published 2 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.1.0; Red Hat Advanced Cluster Security for Kubernetes 4.8.9.
Is there a fix for CVE-2026-24737?: Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24737 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24737?: Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.1.0 or later
```
npm install jspdf@4.1.0
```

Technical details

A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the API members AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState fail to sanitize input, allowing an attacker to inject arbitrary PDF objects. By crafting a payload that closes existing arrays and injects Additional Action (/AA) or JavaScript (/JS) keys, an attacker can execute arbitrary JavaScript when a victim opens the generated document. This requires the application to pass unsanitized user input into the affected jsPDF methods. The issue is resolved in version 4.1.0.

Affected products

parallax jsPDF < 4.1.0
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8 4.8.9
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.9 4.9.0

Identifiers

CVE-2026-24737
GHSA-pqxr-3g65-p328

Timeline

2026-02-02: disclosed
2026-02-02: patched: Fixed in jsPDF version 4.1.0
2026-02-02: advisory
2026-03-12: advisory: Red Hat advisory RHSA-2026:4466 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.