GitHub Advisoryadvisory · npm

GHSA-h3q6-jfrg-3x6q survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

CRITICAL Published 2026-02-04 Modified 2026-02-05 Official page ↗
Aliases
CVE-2026-25630
Ecosystem
npm
Packages
survey-pdf
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Weaknesses
CWE-35, CWE-73
Reviewed
2026-02-04

Affected packages

• npm survey-pdf: < 1.12.59 → fixed in 1.12.59 • npm survey-pdf: >= 2.0.0, < 2.5.5 → fixed in 2.5.5

Description

The following security vulnerability was identified in jsPDF versions = 4.0.0 and included the fix in the following `survey-pdf` releases: • v1.12.59 • v2.5.5 Action Users should upgrade `survey-pdf` in their projects to v1.12.59+ or v2.5.5+ immediately. Notes No other `survey-pdf` dependencies are affected. This update is fully backward-compatible with previous `survey-pdf` releases.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-35 Path Traversal: '.../...//' weakness
  • CWE-73 External Control of File Name or Path weakness

References