Race condition in jspdf - CVE-2026-24040

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127965

Race condition in jspdf - CVE-2026-24040

Published: April 27, 2026


Vulnerability identifier: #VU127965
CSH Severity: Medium
CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2026-24040
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a race condition in the addJS method when generating PDFs concurrently. A remote attacker can trigger simultaneous PDF generation requests to disclose sensitive information.

This can cause a PDF generated for one user to contain JavaScript content and embedded sensitive data intended for another user.


Affected software

jspdf
InfoSphere Optim Archive Viewer

How to mitigate CVE-2026-24040

Install security update from vendor's website.

jspdf - update to 4.1.0
InfoSphere Optim Archive Viewer - update to 1.7.0.13 FixPack 13

External References

Related Security Bulletins