Junglewise Threat Intelligence

CVE-2026-25940: parallax jsPDF PDF injection in Acroform module

CVE-2026-25940 · Severity: high · CVSS 8.1 · Published 2026-02-19

Executive brief

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in its form-handling module allows attackers to embed malicious JavaScript code into generated PDFs. If a user opens such a PDF and interacts with certain elements, like hovering over a radio button, the hidden code could execute, potentially leading to data theft or unauthorized actions on the user's behalf.

Technical details

A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the 'appearanceState' property in the AcroformChildClass does not sufficiently sanitize input, allowing an attacker to inject arbitrary PDF objects. When a victim hovers over a radio button option containing this malicious payload, the injected JavaScript actions are executed. This is a remote attack that requires minimal user interaction (hovering) and no prior authentication. The issue is resolved in version 4.2.0; users on older versions should sanitize all input passed to Acroform API members.

Affected products

  • parallax jsPDF < 4.2.0
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

Timeline

  • 2026-02-19: disclosed
  • 2026-02-19: patched: Fixed in version 4.2.0
  • 2026-02-19: advisory

References

Related threats