CVE-2026-31938 jsPDF has HTML Injection in New Window paths
Attackers can inject arbitrary HTML and scripts into the browser context when victims open PDFs generated with unsanitized user-controlled options in jsPDF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-31938?
CVE-2026-31938 is a critical cross-site scripting vulnerability in parallax jsPDF, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
Weakness: CWE-79
Which versions are affected by CVE-2026-31938?
2 open source packages ship an affected version, including jspdf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jspdf npm | All versions | 4.2.1 |
jspdf npm | All versions | 4.2.1 |
Products include Parall Jspdf.
How do I fix CVE-2026-31938?
Upgrade jspdf to 4.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-31938 being exploited?
There is no known exploitation of CVE-2026-31938 in the wild and no public exploit code.
Other vulnerabilities in parallax jsPDF
- CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability
- CVE-2026-25535 jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
- CVE-2026-24133 jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
- CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)
- CVE-2025-29907 jsPDF Bypass Regular Expression Denial of Service (ReDoS)
Sources
Also known as GHSA-wfv2-pwc8-crg5, MINI-5gq5-pj24-hvr5, MINI-x4vw-cvcr-33xf, MINI-x5fr-xr8g-f6vp, ROOT-APP-NPM-CVE-2026-31938.