CVE-2026-31938: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in parallax jsPDF
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-31938) in the jsPDF library (parallax project) is an improper neutralization of input during web page generation (CWE-79). Specifically, prior to version 4.2.1, the output function's options argument can be controlled by an attacker to inject arbitrary HTML or scripts. This occurs because user-supplied values are passed unsanitized to the PDF generation context, enabling script execution in the victim's browser when the PDF is opened. The vulnerability has a CVSS 3.1 score of 9.6 (critical) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity, and low impact on availability. The issue is resolved in jsPDF version 4.2.1. As a workaround, input sanitization before passing to the output method is recommended.
Potential Impact
Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser context when the victim generates and opens a PDF using the vulnerable jsPDF output function. This can lead to disclosure or modification of sensitive information accessible in the browser context. The vulnerability affects confidentiality and integrity with high severity and has a low impact on availability.
Mitigation Recommendations
An official fix is available in jsPDF version 4.2.1. Users should upgrade to version 4.2.1 or later to remediate this vulnerability. As a temporary mitigation, sanitize all user input before passing it to the output function's options argument to prevent injection of malicious HTML or scripts.
CVE-2026-31938: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in parallax jsPDF
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
CVSS v3.1
Score 9.6critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-31938) in the jsPDF library (parallax project) is an improper neutralization of input during web page generation (CWE-79). Specifically, prior to version 4.2.1, the output function's options argument can be controlled by an attacker to inject arbitrary HTML or scripts. This occurs because user-supplied values are passed unsanitized to the PDF generation context, enabling script execution in the victim's browser when the PDF is opened. The vulnerability has a CVSS 3.1 score of 9.6 (critical) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity, and low impact on availability. The issue is resolved in jsPDF version 4.2.1. As a workaround, input sanitization before passing to the output method is recommended.
Potential Impact
Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser context when the victim generates and opens a PDF using the vulnerable jsPDF output function. This can lead to disclosure or modification of sensitive information accessible in the browser context. The vulnerability affects confidentiality and integrity with high severity and has a low impact on availability.
Mitigation Recommendations
An official fix is available in jsPDF version 4.2.1. Users should upgrade to version 4.2.1 or later to remediate this vulnerability. As a temporary mitigation, sanitize all user input before passing it to the output function's options argument to prevent injection of malicious HTML or scripts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-10T15:10:10.655Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-31938","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","vendor":"Red Hat"}]
Threat ID: 69ba1bd6771bdb17491a1d61
Added to database: 03/18/2026, 03:28:22 UTC
Last enriched: 07/22/2026, 22:44:07 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 274
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.