CVE-2026-22787: html2pdf.js XSS Vulnerability

CVE-2026-22787 Overview

CVE-2026-22787 is a Cross-Site Scripting (XSS) vulnerability in html2pdf.js, a popular client-side JavaScript library that converts webpages or HTML elements into printable PDF documents. Prior to version 0.14.0, html2pdf.js fails to sufficiently sanitize text input before attaching it to the DOM when processing text sources rather than HTML elements. This allows attackers to inject malicious scripts that execute in the context of the victim's browser session.

Critical Impact

This XSS vulnerability enables attackers to execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, defacement, or malware distribution through applications using the vulnerable html2pdf.js library.

Affected Products

• html2pdf.js versions prior to 0.14.0
• Web applications integrating vulnerable html2pdf.js versions for client-side PDF generation

Discovery Timeline

• January 14, 2026 - CVE-2026-22787 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22787

Vulnerability Analysis

The vulnerability resides in how html2pdf.js handles text-based input sources. When developers pass a text string to the library for PDF conversion instead of a DOM element reference, the library fails to properly sanitize this input before inserting it into the Document Object Model (DOM). This creates an injection point where malicious JavaScript can be embedded within the text content.

The attack surface exists because the library's text handling pathway lacks the same security controls applied to element-based inputs. When the unsanitized text is attached to the DOM for rendering, any embedded script tags or event handlers execute immediately in the user's browser context.

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. Successful exploitation requires user interaction, as the victim must trigger the PDF generation functionality with attacker-controlled input.

Root Cause

The root cause is insufficient input sanitization in the text source processing pathway of html2pdf.js. When text content is passed to the library, it is directly inserted into the DOM without encoding HTML special characters or stripping potentially dangerous script elements. The fix implemented in version 0.14.0 adds proper sanitization to ensure text inputs are safely escaped before DOM insertion.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by crafting malicious input that gets processed by html2pdf.js as a text source. Attack scenarios include:

1. Reflected XSS: User-supplied data passed directly to html2pdf.js text processing without server-side validation
2. Stored XSS: Malicious payloads stored in databases that are later retrieved and processed by the vulnerable library
3. DOM-based XSS: Client-side JavaScript that pulls attacker-controlled data into html2pdf.js text processing

The exploitation mechanism involves injecting script content within text that is subsequently rendered by the library. When html2pdf.js processes this malicious text and attaches it to the DOM, the embedded scripts execute with full access to the page context, cookies, and session data.

Technical details regarding the specific vulnerable code path and patch implementation can be found in the GitHub Security Advisory and the associated commit.

Detection Methods for CVE-2026-22787

Indicators of Compromise

• Unusual JavaScript execution patterns originating from PDF generation functionality
• Client-side errors or warnings related to html2pdf.js processing unexpected content
• Reports of unexpected browser behavior when users interact with PDF export features
• Evidence of data exfiltration attempts to unknown domains triggered during PDF generation

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor web application logs for suspicious input patterns targeting PDF generation endpoints
• Conduct software composition analysis (SCA) scans to identify applications using html2pdf.js versions prior to 0.14.0
• Deploy browser-based XSS detection tools that can identify DOM manipulation anomalies

Monitoring Recommendations

• Enable CSP violation reporting to capture attempted XSS exploitation in production environments
• Monitor client-side error tracking systems for html2pdf.js-related exceptions
• Review application dependency manifests regularly to ensure html2pdf.js is updated to 0.14.0 or later
• Implement runtime application self-protection (RASP) to detect malicious script injection attempts

How to Mitigate CVE-2026-22787

Immediate Actions Required

• Upgrade html2pdf.js to version 0.14.0 or later immediately across all affected applications
• Audit all code paths that pass user-controlled data to html2pdf.js text processing functions
• Implement server-side input validation and sanitization as a defense-in-depth measure
• Deploy Content Security Policy headers to mitigate XSS impact if immediate patching is not possible

Patch Information

The vulnerability has been fixed in html2pdf.js version 0.14.0. The patch implements proper input sanitization for text sources before DOM attachment, preventing script injection. Organizations should update their dependencies using their package manager:

• npm: npm update html2pdf.js or npm install html2pdf.js@0.14.0
• yarn: yarn upgrade html2pdf.js@0.14.0

For detailed information about the fix, refer to the GitHub Release v0.14.0 and the Pull Request #877.

Workarounds

• If immediate upgrade is not possible, sanitize all user input before passing it to html2pdf.js using a trusted HTML sanitization library such as DOMPurify
• Restrict html2pdf.js to only accept DOM element references rather than text strings where possible
• Implement strict Content Security Policy headers with script-src directives to prevent inline script execution
• Consider server-side PDF generation as an alternative to client-side processing for sensitive applications

# Update html2pdf.js to patched version
npm install html2pdf.js@0.14.0 --save

# Verify installed version
npm list html2pdf.js

# Alternative: Add to package.json with minimum version constraint
# "html2pdf.js": ">=0.14.0"