CVE-2026-25755highCWE-116CWE-94

CVE-2026-25755: falha de alta gravidade em parallax jsPDF

jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jsPDF+ Monitorar jspdf

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.0%
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
parallax · jsPDF
CVEs relacionadas — parallax jsPDF

No mesmo produto, das mais perigosas para as menos.

CVE-2025-68428CRITICALjsPDF has Local File Inclusion/Path Traversal vulnerabilityEPSS 2.2%CVE-2026-25535HIGHjsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsEPSS 0.8%CVE-2025-29907HIGHjsPDF Bypass Regular Expression Denial of Service (ReDoS)EPSS 0.7%CVE-2025-57810HIGHjsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)EPSS 0.7%CVE-2026-24133HIGHjsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoderEPSS 0.6%CVE-2026-24737HIGHjsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionEPSS 0.6%