CVE-2026-25940 is a high-severity vulnerability in the parallax jsPDF library affecting versions prior to 4.2.0. It involves improper encoding or escaping of output in the Acroform module, allowing attackers to inject arbitrary PDF objects including JavaScript actions. These injected actions execute when a victim hovers over a radio option in the generated PDF. The vulnerability is addressed by the official fix in jsPDF 4.2.0. Until upgrading, sanitizing user input before passing it to the affected properties and methods mitigates the risk.

Successful exploitation allows an attacker to inject arbitrary PDF objects such as JavaScript actions that execute in the context of the PDF viewer when the victim interacts with form elements. This can lead to high confidentiality and integrity impacts by executing malicious code within the PDF environment. Availability is not impacted.

An official fix is available in jsPDF version 4.2.0. Users should upgrade to version 4.2.0 or later to remediate this vulnerability. As a temporary workaround, sanitize all user input before passing it to the vulnerable Acroform module properties and methods to prevent injection of arbitrary PDF objects.