Executive brief
jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in its form-handling module allows attackers to embed malicious JavaScript code into generated PDFs. If a user opens such a PDF and interacts with certain elements, like hovering over a radio button, the hidden code could execute, potentially leading to data theft or unauthorized actions on the user's behalf.
Technical details
A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the 'appearanceState' property in the AcroformChildClass does not sufficiently sanitize input, allowing an attacker to inject arbitrary PDF objects. When a victim hovers over a radio button option containing this malicious payload, the injected JavaScript actions are executed. This is a remote attack that requires minimal user interaction (hovering) and no prior authentication. The issue is resolved in version 4.2.0; users on older versions should sanitize all input passed to Acroform API members.
Affected products
- parallax jsPDF < 4.2.0
- Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9
Timeline
- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in version 4.2.0
- 2026-02-19: advisory
References
- https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375
- https://github.com/parallax/jsPDF/releases/tag/v4.2.0
- https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m
- https://access.redhat.com/errata/RHSA-2026:7110
- https://access.redhat.com/errata/RHSA-2026:7128
- https://access.redhat.com/security/cve/CVE-2026-25940
- https://bugzilla.redhat.com/show_bug.cgi?id=2441016