Junglewise Threat Intelligence

CVE-2026-31898: parallax jsPDF PDF object injection in createAnnotation

CVE-2026-31898 · Severity: high · CVSS 8.1 · Published 2026-03-18

Executive brief

jsPDF is a popular JavaScript library used by developers to generate PDF documents within web applications. A security flaw in how the library handles document annotations allows an attacker to inject malicious code into a generated PDF. If a user opens or interacts with a specially crafted PDF created by a vulnerable application, it could lead to unauthorized actions on the user's computer or the theft of sensitive information.

Technical details

A PDF object injection vulnerability exists in jsPDF due to improper encoding and escaping of the 'color' parameter within the 'createAnnotation' method. By providing unsanitized input to this parameter, an attacker can break out of the intended data structure and inject arbitrary PDF objects, including JavaScript actions (/AA or /OpenAction). The attack vector is remote and requires a user to open or interact with the malicious PDF (User Interaction Required). Successful exploitation can lead to arbitrary code execution or information disclosure within the context of the PDF viewer. The issue is fixed in version 4.2.1 by implementing hex validation and improved string escaping.

Affected products

  • parallax jsPDF < 4.2.1
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8 4.8.10
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.9 4.9.0

Timeline

  • 2026-03-17: patched: Fixed in version 4.2.1
  • 2026-03-17: advisory: GitHub Security Advisory GHSA-7x6v-j9x4-qf24 published
  • 2026-03-18: disclosed: CVE-2026-31898 published to NVD
  • 2026-04-08: patched: Red Hat released RHSA-2026:7110 for RHACS 4.8.10

References

Related threats