CVE-2026-31938: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in parallax jsPDF
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
AI Analysis
Technical Summary
jsPDF versions before 4.2.1 contain a CWE-79 improper neutralization of input vulnerability in the output function. Attackers can supply malicious values to the options argument, which are not sanitized before being used to generate PDFs. When victims open these PDFs in a browser, the embedded scripts execute, enabling cross-site scripting attacks that can compromise confidentiality and integrity by stealing or altering sensitive data. The issue is fixed in version 4.2.1. Red Hat's advisory confirms the vulnerability and notes no current mitigation meets their criteria beyond upgrading or input sanitization.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary scripts in the victim's browser context when opening a PDF generated by vulnerable jsPDF versions. This can lead to theft or modification of sensitive information accessible in the browser, including cookies and session data. The vulnerability has a CVSS 3.1 score of 9.6 (critical), indicating high impact on confidentiality and integrity with low attack complexity and no privileges required. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in jsPDF version 4.2.1. Users should upgrade to this version to remediate the vulnerability. As a workaround, sanitize all user-supplied input passed to the output function's options argument to prevent injection of malicious HTML or scripts. Red Hat notes that no other mitigation currently meets their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
CVE-2026-31938: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in parallax jsPDF
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround, sanitize user input before passing it to the output method.
CVSS v3.1
Score 9.6critical
Affected software
parallax
jsPDF
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
jsPDF versions before 4.2.1 contain a CWE-79 improper neutralization of input vulnerability in the output function. Attackers can supply malicious values to the options argument, which are not sanitized before being used to generate PDFs. When victims open these PDFs in a browser, the embedded scripts execute, enabling cross-site scripting attacks that can compromise confidentiality and integrity by stealing or altering sensitive data. The issue is fixed in version 4.2.1. Red Hat's advisory confirms the vulnerability and notes no current mitigation meets their criteria beyond upgrading or input sanitization.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary scripts in the victim's browser context when opening a PDF generated by vulnerable jsPDF versions. This can lead to theft or modification of sensitive information accessible in the browser, including cookies and session data. The vulnerability has a CVSS 3.1 score of 9.6 (critical), indicating high impact on confidentiality and integrity with low attack complexity and no privileges required. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in jsPDF version 4.2.1. Users should upgrade to this version to remediate the vulnerability. As a workaround, sanitize all user-supplied input passed to the output function's options argument to prevent injection of malicious HTML or scripts. Red Hat notes that no other mitigation currently meets their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-10T15:10:10.655Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-31938","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","vendor":"Red Hat"}]
Threat ID: 69ba1bd6771bdb17491a1d61
Added to database: 03/18/2026, 03:28:22 UTC
Last enriched: 08/17/2026, 13:15:21 UTC
Last updated: 09/13/2026, 10:01:30 UTC
Views: 309
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.