CVE-2026-31938 - Vulnerability Analysis

Overview

jsPDF < 4.2.1 contains a stored XSS caused by unsanitized user control of the options argument in the output function, letting attackers inject arbitrary scripts in the victim's browser context, exploit requires victim to create and open a crafted PDF.

Severity & Score

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially stealing or modifying sensitive information.

Mitigation

Update to version 4.2.1 or later; sanitize user input before passing to output method.

References

• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1
• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🔴 CVE-2026-31938 - Critical (9.6) jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is open... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31938/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner