Is CVE-2026-31898 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31898 being exploited in the wild.

How severe is CVE-2026-31898?

High severity, with a CVSS score of 8.1, published 18 March 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.2.1; Red Hat Advanced Cluster Security for Kubernetes 4.8.10.

Is there a fix for CVE-2026-31898?

Yes. jspdf (npm): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-31898 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-31898?

Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31898: parallax jsPDF PDF object injection in createAnnotation

CVE-2026-31898 · Severity: high · CVSS 8.1 · Published 2026-03-18

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in how the library handles document annotations allows an attacker to inject malicious code into a generated PDF. If a user opens or interacts with a specially crafted PDF created by a vulnerable application, it could lead to unauthorized actions on the user's computer or the theft of sensitive information.

Technologies: jspdf (npm), Red Hat Advanced Cluster Security for Kubernetes. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-31898 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31898 being exploited in the wild.
How severe is CVE-2026-31898?: High severity, with a CVSS score of 8.1, published 18 March 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.2.1; Red Hat Advanced Cluster Security for Kubernetes 4.8.10.
Is there a fix for CVE-2026-31898?: Yes. jspdf (npm): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31898 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-31898?: Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.2.1 or later
```
npm install jspdf@4.2.1
```

Technical details

A PDF object injection vulnerability exists in jsPDF due to improper encoding and escaping of the 'color' parameter within the 'createAnnotation' method. By providing unsanitized input to this parameter, an attacker can break out of the intended data structure and inject arbitrary PDF objects, including JavaScript actions (/AA or /OpenAction). The attack vector is remote and requires a user to open or interact with the malicious PDF (User Interaction Required). Successful exploitation can lead to arbitrary code execution or information disclosure within the context of the PDF viewer. The issue is fixed in version 4.2.1 by implementing hex validation and improved string escaping.

Affected products

parallax jsPDF < 4.2.1
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8 4.8.10
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.9 4.9.0

Identifiers

CVE-2026-31898
GHSA-7x6v-j9x4-qf24

Timeline

2026-03-17: patched: Fixed in version 4.2.1
2026-03-17: advisory: GitHub Security Advisory GHSA-7x6v-j9x4-qf24 published
2026-03-18: disclosed: CVE-2026-31898 published to NVD
2026-04-08: patched: Red Hat released RHSA-2026:7110 for RHACS 4.8.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.