What is the CVSS score of CVE-2026-25755?

CVE-2026-25755 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of jsPDF are affected by CVE-2026-25755?

jsPDF versions prior to 4.2.0 contain a PDF object injection vulnerability; publicly available exploit code exists that allows attackers to inject malicious auto-executing PDF actions, potentially…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25755?

Yes, a public proof-of-concept exploit is available for CVE-2026-25755. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25755?

Within 24 hours: Execute dependency audit (npm list jspdf) to identify affected systems and current versions; review applications using jsPDF's addJS() method with potentially untrusted input. Within 7 days: Validate jsPDF 4.2.0 or later in staging environments and prepare rollback procedures. Within 30 days: Deploy patched version to all production systems and verify existing PDF functionality remains operational.

jsPDF CVE-2026-25755

HIGH

Code Injection (CWE-94)

2026-02-19 security-advisories@github.com

GHSA-9vjf-qc39-jprp

RCE Code Injection Jspdf Parall

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Network-delivered PDF (AV:N) with no auth (PR:N) but victim must open it (UI:R); primary effect is altering document structure/actions (I:H), with limited, viewer-sandboxed confidentiality and availability impact (C:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:40 vuln.today

v5 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 05:39 vuln.today

Analysis Updated

Jun 30, 2026 - 05:39 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:39 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:23 NVD

8.1 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 23, 2026 - 18:52 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 18:52 nvd

Patch available

CVE Published

Feb 19, 2026 - 15:16 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on jspdf (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.2.0.

DescriptionNVD

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the addJS method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the addJS method.

AnalysisAI

PDF object injection in the jsPDF JavaScript library (npm package 'jspdf', versions prior to 4.2.0) lets an attacker who controls the string passed to the addJS method break out of the PDF JavaScript string delimiter and inject arbitrary PDF dictionary objects, including auto-executing Additional Actions (/AA). Any user who later opens the generated PDF in a JavaScript-capable viewer executes the injected actions, affecting confidentiality, integrity and availability of their document session. Publicly available exploit code exists (a documented payload is published in the GitHub advisory), but EPSS is very low (0.04%, 10th percentile) and the issue is not in CISA KEV.

Technical ContextAI

jsPDF is a browser/Node.js library that programmatically builds PDF files. The addJS method is meant to embed document-level JavaScript (e.g. an autoprint action) by wrapping the supplied code inside a PDF string object of the form '/JS (...)'. Because the PDF string syntax uses parentheses as delimiters, the pre-4.2.0 code inserted the raw user string without escaping '(' and ')'. This is a classic CWE-94 (Improper Control of Generation of Code / Code Injection) root cause: untrusted data is concatenated into a structured serialization context without sanitization, so a ')' prematurely closes the JS string and following bytes ('>>', '/AA << ... >>') are parsed by the PDF reader as new objects rather than literal data. The affected component is the parall/parallax jsPDF package (CPE cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*). The 4.2.0 fix adds an escapeParens() routine that backslash-escapes only unescaped parentheses (avoiding double-escaping), so the entire payload stays inside the string literal.

RemediationAI

Vendor-released patch: 4.2.0 - upgrade the jspdf dependency to 4.2.0 or later (release https://github.com/parallax/jsPDF/releases/tag/v4.2.0, fixing commit 56b46d45b052346f5995b005a34af5dcdddd5437) and rebuild/redeploy any bundled front-end assets that vendor the library. Red Hat consumers should apply the platform errata RHSA-2026:7110 and RHSA-2026:7128. If you cannot upgrade immediately, the vendor-documented workaround is to escape parentheses in any user-provided JavaScript before passing it to addJS (replace '(' and ')' with their backslash-escaped forms, matching the library's own escapeParens logic), which neutralizes the string-breakout but must be applied consistently or it provides no protection; alternatively avoid feeding untrusted data into addJS at all, or strip/disallow document-level JavaScript in generated PDFs if the autoprint/scripting feature is not required, accepting the loss of that functionality.