The jsPDF library's addJS method prior to version 4.2.0 improperly controls the generation of code by accepting user input without adequate sanitization. This flaw allows attackers to craft payloads that escape JavaScript string delimiters, injecting arbitrary PDF objects and enabling execution of malicious JavaScript code embedded in the PDF. Exploitation requires an attacker to supply a crafted payload to the addJS method and convince a user to open the malicious PDF in a compatible viewer. The vulnerability is tracked as CVE-2026-25755 and classified under CWE-94 (Improper Control of Generation of Code). The issue was fixed in jsPDF version 4.2.0, and a mitigation involves escaping backslashes and parentheses in user-provided JavaScript code before passing it to addJS.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the context of the PDF viewer when a user opens a maliciously crafted PDF document. This can lead to unauthorized actions or alteration of the document structure, impacting confidentiality and integrity. The vulnerability does not affect the application using jsPDF directly but poses a risk to end users who open the generated PDFs. The CVSS v3.1 base score is 8.1 (high severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

A fix is available in jsPDF version 4.2.0; users should upgrade to this version to remediate the vulnerability. As a workaround, sanitize user-provided JavaScript code by strictly escaping backslashes and parentheses before passing it to the addJS method. Additionally, users should avoid opening PDF documents from untrusted sources. The vendor advisory confirms the availability of an official fix and recommends these mitigations.