# CVE-2026-25940: parallax jsPDF PDF injection in Acroform module

Source: https://junglewise.ai/threats/cve-2026-25940-parallax-jspdf-pdf-injection-in-acroform-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25940 · Severity: high · CVSS 8.1 · Published 2026-02-19

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in its form-handling module allows attackers to embed malicious JavaScript code into generated PDFs. If a user opens such a PDF and interacts with certain elements, like hovering over a radio button, the hidden code could execute, potentially leading to data theft or unauthorized actions on the user's behalf.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf), [Red Hat Advanced Cluster Security for Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-security-for-kubernetes). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-25940 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25940 being exploited in the wild.

**How severe is CVE-2026-25940?** High severity, with a CVSS score of 8.1, published 19 February 2026.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=4.2.0; Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9.

**Is there a fix for CVE-2026-25940?** Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25940 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25940?** Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 4.2.0 or later

  ```sh
  npm install jspdf@4.2.0
  ```


## Technical details

A PDF injection vulnerability exists in the Acroform module of jsPDF due to improper encoding or escaping of output (CWE-116). Specifically, the 'appearanceState' property in the AcroformChildClass does not sufficiently sanitize input, allowing an attacker to inject arbitrary PDF objects. When a victim hovers over a radio button option containing this malicious payload, the injected JavaScript actions are executed. This is a remote attack that requires minimal user interaction (hovering) and no prior authentication. The issue is resolved in version 4.2.0; users on older versions should sanitize all input passed to Acroform API members.

## Affected products

- parallax jsPDF < 4.2.0
- Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

## Identifiers

- CVE-2026-25940
- GHSA-p5xg-68wr-hm3m

## Timeline

- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in version 4.2.0
- 2026-02-19: advisory

## References

- [https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375](https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375)
- [https://github.com/parallax/jsPDF/releases/tag/v4.2.0](https://github.com/parallax/jsPDF/releases/tag/v4.2.0)
- [https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m](https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m)
- [https://access.redhat.com/errata/RHSA-2026:7110](https://access.redhat.com/errata/RHSA-2026:7110)
- [https://access.redhat.com/errata/RHSA-2026:7128](https://access.redhat.com/errata/RHSA-2026:7128)
- [https://access.redhat.com/security/cve/CVE-2026-25940](https://access.redhat.com/security/cve/CVE-2026-25940)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2441016](https://bugzilla.redhat.com/show_bug.cgi?id=2441016)

## Related threats

- [Red Hat Advanced Cluster Security for Kubernetes SAML replay attack](https://junglewise.ai/threats/cve-2026-103314-a-flaw-was-found-in-red-hat-advanced-cluster-security-for)
- [Red Hat Advanced Cluster Security privilege escalation in M2M auth](https://junglewise.ai/threats/cve-2026-19278-red-hat-advanced-cluster-security-privilege-escalation-in-m2m)
- [Red Hat Advanced Cluster Security policy bypass via label injection](https://junglewise.ai/threats/cve-2026-10079-red-hat-advanced-cluster-security-policy-bypass-via-label)
- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)