The vulnerability (CVE-2026-24737) in jsPDF affects versions prior to 4.1.0 and involves improper encoding or escaping of output in the Acroform module. Specifically, methods and properties such as AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState allow injection of arbitrary PDF objects including JavaScript actions. When a victim opens a maliciously crafted PDF, these injected JavaScript actions execute, leading to arbitrary code execution. The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output) and CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement). The issue has been fixed in jsPDF version 4.1.0, and Red Hat has released security advisories and updates for affected products.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within a PDF document when opened by a victim, potentially leading to arbitrary code execution. This compromises confidentiality and integrity of the victim's environment. The attack requires user interaction (opening a malicious PDF). There is no indication of availability impact. Red Hat products using jsPDF, such as RHACS, are affected and have been updated accordingly.

A fix is available in jsPDF version 4.1.0. Users and vendors should upgrade to this version or later to remediate the vulnerability. Additionally, avoid processing untrusted or unverified PDF documents with applications using the vulnerable jsPDF versions. Ensure that any input passed to the Acroform module methods and properties is properly sanitized to prevent injection of arbitrary PDF objects and JavaScript actions. Red Hat has released updated images and advisories for affected products such as RHACS. Follow vendor advisories for applying patches and updates.