Is CVE-2026-25755 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25755 being exploited in the wild.

How severe is CVE-2026-25755?

High severity, with a CVSS score of 8.1, published 19 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.

Is there a fix for CVE-2026-25755?

Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25755 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25755?

Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25755: parallax jsPDF PDF object injection in addJS method

CVE-2026-25755 · Severity: high · CVSS 8.1 · Published 2026-02-19

jsPDF is a popular JavaScript library used by web applications to generate PDF documents. A security flaw allows attackers to inject malicious code or hidden commands into generated PDFs if the application uses untrusted user input. When a victim opens such a PDF, the injected content could lead to unauthorized actions, data theft, or the display of deceptive information, even if the user has disabled JavaScript in their PDF viewer.

Technologies: jspdf (npm), Red Hat Advanced Cluster Security for Kubernetes. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-25755 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25755 being exploited in the wild.
How severe is CVE-2026-25755?: High severity, with a CVSS score of 8.1, published 19 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.
Is there a fix for CVE-2026-25755?: Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25755 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25755?: Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.2.0 or later
```
npm install jspdf@4.2.0
```

Technical details

A PDF Object Injection vulnerability exists in the `addJS` method of jsPDF due to improper sanitization of the closing parenthesis `)` character. In the PDF specification, the parenthesis acts as a delimiter for literal strings; by providing a crafted payload, an attacker can escape the intended JavaScript string context and inject raw PDF dictionaries and actions (e.g., `/AA` or `/OpenAction`). This bypasses typical PDF JavaScript sandboxes and can execute even in viewers where JavaScript is disabled. The vulnerability is fixed in version 4.2.0 by properly escaping parentheses and backslashes.

Affected products

parallax jsPDF < 4.2.0
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

Identifiers

CVE-2026-25755
GHSA-9vjf-qc39-jprp

Timeline

2026-02-19: disclosed
2026-02-19: patched: Fixed in jsPDF v4.2.0
2026-02-19: advisory
2026-04-08: patched: Red Hat released RHSA-2026:7110 for RHACS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.