CVE-2026-25940: CWE-116: Improper Encoding or Escaping of Output in parallax jsPDF
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the vulnerable API members.
AI Analysis
Technical Summary
The vulnerability in jsPDF (CVE-2026-25940) arises from the Acroform module accepting unsanitized user input in properties like AcroformChildClass.appearanceState. This flaw allows attackers to inject arbitrary PDF objects, including JavaScript actions, which execute when a user opens the PDF and hovers over radio buttons. The issue is classified under CWE-116 (Improper Encoding or Escaping of Output). The vulnerability has been addressed and fixed in jsPDF version 4.2.0. The Red Hat advisory confirms the impact and provides mitigation guidance emphasizing input sanitization and cautious handling of PDFs from untrusted sources.
Potential Impact
An attacker who can supply specially crafted input to the Acroform module can inject arbitrary JavaScript into a PDF document. This JavaScript executes when a user opens the PDF and interacts with radio buttons, potentially compromising confidentiality and integrity. The CVSS 3.1 score is 8.1 (High), indicating network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in jsPDF version 4.2.0. Users should upgrade to this version to remediate the vulnerability. Until upgrading, sanitize all user-provided input before passing it to the AcroformChildClass.appearanceState property or other related API members. Additionally, avoid opening PDF documents from untrusted or unknown sources to reduce risk.
CVE-2026-25940: CWE-116: Improper Encoding or Escaping of Output in parallax jsPDF
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the vulnerable API members.
CVSS v3.1
Score 8.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jsPDF (CVE-2026-25940) arises from the Acroform module accepting unsanitized user input in properties like AcroformChildClass.appearanceState. This flaw allows attackers to inject arbitrary PDF objects, including JavaScript actions, which execute when a user opens the PDF and hovers over radio buttons. The issue is classified under CWE-116 (Improper Encoding or Escaping of Output). The vulnerability has been addressed and fixed in jsPDF version 4.2.0. The Red Hat advisory confirms the impact and provides mitigation guidance emphasizing input sanitization and cautious handling of PDFs from untrusted sources.
Potential Impact
An attacker who can supply specially crafted input to the Acroform module can inject arbitrary JavaScript into a PDF document. This JavaScript executes when a user opens the PDF and interacts with radio buttons, potentially compromising confidentiality and integrity. The CVSS 3.1 score is 8.1 (High), indicating network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in jsPDF version 4.2.0. Users should upgrade to this version to remediate the vulnerability. Until upgrading, sanitize all user-provided input before passing it to the AcroformChildClass.appearanceState property or other related API members. Additionally, avoid opening PDF documents from untrusted or unknown sources to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-09T16:22:17.787Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-25940","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","vendor":"Red Hat"}]
Threat ID: 69973033732724e9dc4fe1d3
Added to database: 02/19/2026, 15:45:55 UTC
Last enriched: 08/17/2026, 13:14:26 UTC
Last updated: 08/23/2026, 22:52:09 UTC
Views: 200
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.