Cross-site scripting in jspdf - CVE-2026-31938
Published: April 27, 2026
Vulnerability identifier: #VU127970
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-31938
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary HTML and execute script in the victim's browser context.
The vulnerability exists due to improper neutralization of input during web page generation in the output function when processing user-controlled output options for the "pdfobjectnewwindow", "pdfjsnewwindow", or "dataurlnewwindow" overloads. A remote attacker can supply specially crafted option values to inject arbitrary HTML and execute script in the victim's browser context.
User interaction is required because the victim must create and open the generated PDF in a browser.
Affected software
jspdf
How to mitigate CVE-2026-31938
Install security update from vendor's website.
jspdf - update to 4.2.1