Improper Encoding or Escaping of Output in jspdf - CVE-2026-24737

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127963

Improper Encoding or Escaping of Output in jspdf - CVE-2026-24737

Published: April 27, 2026


Vulnerability identifier: #VU127963
CSH Severity: High
CVSS v4 BT: 6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2026-24737
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript.

The vulnerability exists due to improper encoding or escaping of output in the AcroForm module when processing unsanitized input passed to affected AcroForm methods or properties. A remote attacker can supply crafted input to inject arbitrary PDF objects and execute arbitrary JavaScript.

User interaction is required to open the crafted PDF document.


Affected software

jspdf
InfoSphere Optim Archive Viewer

How to mitigate CVE-2026-24737

Install security update from vendor's website.

jspdf - update to 4.1.0
InfoSphere Optim Archive Viewer - update to 1.7.0.13 FixPack 13

External References

Related Security Bulletins