CVE-2026-31938 - Vulnerability Analysis

Overview

jsPDF < 4.2.1 contains a stored XSS caused by unsanitized user control of the options argument in the output function, letting attackers inject arbitrary scripts in the victim's browser context, exploit requires victim to create and open a crafted PDF.

Severity & Score

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially stealing or modifying sensitive information.

Mitigation

Update to version 4.2.1 or later; sanitize user input before passing to output method.

References

• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1
• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner