jsPDF versions before 4.2.1 contain an improper encoding or escaping vulnerability (CWE-116) in the createAnnotation method. Unsanitized user input passed to the color parameter can be used to inject arbitrary PDF objects such as JavaScript actions. These injected actions may execute upon opening or interacting with the PDF, potentially resulting in arbitrary code execution or sensitive information disclosure. The vulnerability is tracked as CVE-2026-31898 and has a CVSS 3.1 score of 8.1 (high severity). The issue has been fixed in jsPDF version 4.2.1. Vendor advisories note that mitigation options other than upgrading do not meet criteria for ease of use or stability.

Successful exploitation allows remote attackers to inject and execute arbitrary JavaScript code within generated PDFs, potentially leading to arbitrary code execution or disclosure of sensitive information. The vulnerability requires user interaction (opening or interacting with the PDF) but does not require privileges or authentication. The integrity and confidentiality of affected systems may be compromised.

Upgrade to jsPDF version 4.2.1 or later, which contains the official fix for this vulnerability. As a workaround, sanitize all user input before passing it to the createAnnotation method, especially the color parameter. Vendor advisories indicate that other mitigations do not meet criteria for broad applicability or stability, so upgrading is strongly recommended.