CVE-2026-31938jsPDF has HTML Injection in New Window paths
- 9.6CriticalCVSS base score
- 0.32%Exploitation in 30 daysEPSS · top 75% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
Timeline
ID reserved
By GitHub_M
- 8 days later
· 8 days later
Published
- 6 months later
· 6 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Critical9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L |
| redhat-SADPADP (enrichment) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.32% · top 75% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.6.
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
References
References8
- https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7 (opens in a new tab)x_refsource_MISC
- https://github.com/parallax/jsPDF/releases/tag/v4.2.1 (opens in a new tab)x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-31938 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2448550 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31938.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:7110 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7128 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-12755 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-wfv2-pwc8-crg5 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-31938)Record last updated .