# CVE-2026-25755: parallax jsPDF PDF object injection in addJS method

Source: https://junglewise.ai/threats/cve-2026-25755-parallax-jspdf-pdf-object-injection-in-addjs-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25755 · Severity: high · CVSS 8.1 · Published 2026-02-19

jsPDF is a popular JavaScript library used by web applications to generate PDF documents. A security flaw allows attackers to inject malicious code or hidden commands into generated PDFs if the application uses untrusted user input. When a victim opens such a PDF, the injected content could lead to unauthorized actions, data theft, or the display of deceptive information, even if the user has disabled JavaScript in their PDF viewer.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf), [Red Hat Advanced Cluster Security for Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-security-for-kubernetes). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-25755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25755 being exploited in the wild.

**How severe is CVE-2026-25755?** High severity, with a CVSS score of 8.1, published 19 February 2026.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.

**Is there a fix for CVE-2026-25755?** Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25755 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25755?** Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 4.2.0 or later

  ```sh
  npm install jspdf@4.2.0
  ```


## Technical details

A PDF Object Injection vulnerability exists in the `addJS` method of jsPDF due to improper sanitization of the closing parenthesis `)` character. In the PDF specification, the parenthesis acts as a delimiter for literal strings; by providing a crafted payload, an attacker can escape the intended JavaScript string context and inject raw PDF dictionaries and actions (e.g., `/AA` or `/OpenAction`). This bypasses typical PDF JavaScript sandboxes and can execute even in viewers where JavaScript is disabled. The vulnerability is fixed in version 4.2.0 by properly escaping parentheses and backslashes.

## Affected products

- parallax jsPDF < 4.2.0
- Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

## Identifiers

- CVE-2026-25755
- GHSA-9vjf-qc39-jprp

## Timeline

- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in jsPDF v4.2.0
- 2026-02-19: advisory
- 2026-04-08: patched: Red Hat released RHSA-2026:7110 for RHACS

## References

- [https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md)
- [https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437](https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437)
- [https://github.com/parallax/jsPDF/releases/tag/v4.2.0](https://github.com/parallax/jsPDF/releases/tag/v4.2.0)
- [https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp](https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp)
- [https://access.redhat.com/errata/RHSA-2026:7110](https://access.redhat.com/errata/RHSA-2026:7110)
- [https://access.redhat.com/errata/RHSA-2026:7128](https://access.redhat.com/errata/RHSA-2026:7128)
- [https://access.redhat.com/security/cve/CVE-2026-25755](https://access.redhat.com/security/cve/CVE-2026-25755)

## Related threats

- [Red Hat Advanced Cluster Security for Kubernetes SAML replay attack](https://junglewise.ai/threats/cve-2026-103314-a-flaw-was-found-in-red-hat-advanced-cluster-security-for)
- [Red Hat Advanced Cluster Security privilege escalation in M2M auth](https://junglewise.ai/threats/cve-2026-19278-red-hat-advanced-cluster-security-privilege-escalation-in-m2m)
- [Red Hat Advanced Cluster Security policy bypass via label injection](https://junglewise.ai/threats/cve-2026-10079-red-hat-advanced-cluster-security-policy-bypass-via-label)
- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)