# CVE-2026-24737: parallax jsPDF PDF injection in Acroform module

Source: https://junglewise.ai/threats/cve-2026-24737-parallax-jspdf-pdf-injection-in-acroform-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-24737 · Severity: high · CVSS 8.1 · Published 2026-02-02

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A vulnerability in its form-handling module allows attackers to create malicious PDF files that execute unauthorized code when opened by a user. This could lead to the theft of sensitive information or unauthorized actions being performed on the victim's behalf.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf), [Red Hat Advanced Cluster Security for Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-security-for-kubernetes). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-24737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24737 being exploited in the wild.

**How severe is CVE-2026-24737?** High severity, with a CVSS score of 8.1, published 2 February 2026.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=4.1.0; Red Hat Advanced Cluster Security for Kubernetes 4.8.9.

**Is there a fix for CVE-2026-24737?** Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24737 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24737?** Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 4.1.0 or later

  ```sh
  npm install jspdf@4.1.0
  ```


## Technical details

A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the API members AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState fail to sanitize input, allowing an attacker to inject arbitrary PDF objects. By crafting a payload that closes existing arrays and injects Additional Action (/AA) or JavaScript (/JS) keys, an attacker can execute arbitrary JavaScript when a victim opens the generated document. This requires the application to pass unsanitized user input into the affected jsPDF methods. The issue is resolved in version 4.1.0.

## Affected products

- parallax jsPDF < 4.1.0
- Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8 4.8.9
- Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.9 4.9.0

## Identifiers

- CVE-2026-24737
- GHSA-pqxr-3g65-p328

## Timeline

- 2026-02-02: disclosed
- 2026-02-02: patched: Fixed in jsPDF version 4.1.0
- 2026-02-02: advisory
- 2026-03-12: advisory: Red Hat advisory RHSA-2026:4466 issued

## References

- [https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79](https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79)
- [https://github.com/parallax/jsPDF/releases/tag/v4.1.0](https://github.com/parallax/jsPDF/releases/tag/v4.1.0)
- [https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328](https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328)
- [https://access.redhat.com/errata/RHSA-2026:4466](https://access.redhat.com/errata/RHSA-2026:4466)
- [https://access.redhat.com/errata/RHSA-2026:4467](https://access.redhat.com/errata/RHSA-2026:4467)
- [https://access.redhat.com/security/cve/CVE-2026-24737](https://access.redhat.com/security/cve/CVE-2026-24737)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2436115](https://bugzilla.redhat.com/show_bug.cgi?id=2436115)

## Related threats

- [Red Hat Advanced Cluster Security for Kubernetes SAML replay attack](https://junglewise.ai/threats/cve-2026-103314-a-flaw-was-found-in-red-hat-advanced-cluster-security-for)
- [Red Hat Advanced Cluster Security privilege escalation in M2M auth](https://junglewise.ai/threats/cve-2026-19278-red-hat-advanced-cluster-security-privilege-escalation-in-m2m)
- [Red Hat Advanced Cluster Security policy bypass via label injection](https://junglewise.ai/threats/cve-2026-10079-red-hat-advanced-cluster-security-policy-bypass-via-label)
- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)