Is CVE-2026-25940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25940 being exploited in the wild.

How severe is CVE-2026-25940?

High severity, with a CVSS score of 8.1, published 19 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.

Is there a fix for CVE-2026-25940?

Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25940 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25940?

Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25940: parallax jsPDF PDF injection in Acroform module

CVE-2026-25940 · Severity: high · CVSS 8.1 · Published 2026-02-19

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in its form-handling module allows attackers to embed malicious JavaScript code into generated PDFs. If a user opens such a PDF and interacts with certain elements, like hovering over a radio button, the hidden code could execute, potentially leading to data theft or unauthorized actions on the user's behalf.

Technologies: jspdf (npm), Red Hat Advanced Cluster Security for Kubernetes. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-25940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25940 being exploited in the wild.
How severe is CVE-2026-25940?: High severity, with a CVSS score of 8.1, published 19 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.
Is there a fix for CVE-2026-25940?: Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25940 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25940?: Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.2.0 or later
```
npm install jspdf@4.2.0
```

Technical details

A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the 'appearanceState' property in the AcroformChildClass does not sufficiently sanitize input, allowing an attacker to inject arbitrary PDF objects. When a victim hovers over a radio button option containing this malicious payload, the injected JavaScript actions are executed. This is a remote attack that requires minimal user interaction (hovering) and no prior authentication. The issue is resolved in version 4.2.0; users on older versions should sanitize all input passed to Acroform API members.

Affected products

parallax jsPDF < 4.2.0
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

Identifiers

CVE-2026-25940
GHSA-p5xg-68wr-hm3m

Timeline

2026-02-19: disclosed
2026-02-19: patched: Fixed in version 4.2.0
2026-02-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.