CVE-2026-24737: jsPDF Library XSS Vulnerability

CVE-2026-24737 Overview

CVE-2026-24737 is an arbitrary PDF object injection vulnerability affecting jsPDF, a widely-used JavaScript library for generating PDF documents. Prior to version 4.1.0, the Acroform module allows users to inject arbitrary PDF objects, including malicious JavaScript actions, through unsanitized input passed to specific API methods and properties.

This vulnerability enables attackers to craft malicious PDFs that execute arbitrary JavaScript code when opened by victims. The attack requires user interaction (opening the malicious PDF) but can be exploited remotely over the network without authentication.

Critical Impact

Attackers can inject malicious JavaScript actions into PDF documents generated by vulnerable jsPDF versions, leading to code execution when victims open the crafted documents.

Affected Products

• jsPDF versions prior to 4.1.0
• Applications using vulnerable jsPDF Acroform module API methods
• Web applications accepting user input for PDF form generation

Discovery Timeline

• February 2, 2026 - CVE-2026-24737 published to NVD
• February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24737

Vulnerability Analysis

The vulnerability resides in the Acroform module of jsPDF, which provides functionality for creating interactive PDF forms. The core issue stems from improper encoding of output (CWE-116), where user-controlled input is not adequately sanitized before being incorporated into the PDF document structure.

When applications pass unsanitized user input to specific Acroform API methods, attackers can break out of the intended data context and inject arbitrary PDF objects. This includes the ability to embed JavaScript actions that execute automatically when the generated PDF is opened by a PDF reader.

The attack is network-exploitable and requires no privileges, though user interaction (opening the malicious PDF) is necessary for successful exploitation. The impact includes high confidentiality and integrity compromise, as injected JavaScript can access document data and perform actions on behalf of the user.

Root Cause

The root cause is improper encoding of output (CWE-116) in the Acroform module. The vulnerable API members fail to properly sanitize or escape user-provided values before incorporating them into the PDF object stream. This allows specially crafted input to inject additional PDF objects, breaking the expected document structure and enabling code execution.

The following API members are affected:

• AcroformChoiceField.addOption
• AcroformChoiceField.setOptions
• AcroFormCheckBox.appearanceState
• AcroFormRadioButton.appearanceState

Attack Vector

The attack vector involves an attacker providing malicious input to a web application that uses jsPDF to generate PDF documents with interactive forms. When the application passes this unsanitized input to any of the vulnerable Acroform methods or properties, the attacker's payload becomes embedded in the PDF structure as executable JavaScript.

The malicious PDF is then delivered to victims through normal application channels (download, email, etc.). When a victim opens the PDF document with a JavaScript-enabled PDF reader, the injected code executes automatically, potentially leading to data theft, further exploitation, or other malicious activities.

Since this is an injection vulnerability through improper output encoding, no verified exploit code is provided. For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-pqxr-3g65-p328.

Detection Methods for CVE-2026-24737

Indicators of Compromise

• Generated PDF documents containing unexpected JavaScript actions or embedded scripts
• PDF files with anomalous object structures in the Acroform sections
• Application logs showing unusual input patterns targeting form field options or appearance states
• PDF documents that trigger JavaScript execution warnings in secure PDF readers

Detection Strategies

• Audit application dependencies to identify jsPDF versions prior to 4.1.0
• Implement static code analysis to detect use of vulnerable Acroform API methods with user-controlled input
• Monitor PDF generation endpoints for input patterns attempting object injection
• Deploy PDF content inspection to identify JavaScript actions in generated documents

Monitoring Recommendations

• Enable verbose logging on PDF generation services to capture input parameters
• Implement file integrity monitoring on generated PDF documents
• Set up alerts for applications using outdated jsPDF library versions
• Monitor for reports of unexpected PDF behavior from end users

How to Mitigate CVE-2026-24737

Immediate Actions Required

• Update jsPDF to version 4.1.0 or later immediately
• Audit all applications using jsPDF Acroform functionality for user-controlled input
• Implement input validation and sanitization before passing data to Acroform API methods
• Consider temporarily disabling Acroform functionality if immediate patching is not possible

Patch Information

The vulnerability has been fixed in jsPDF version 4.1.0. The patch implements proper output encoding for all affected Acroform API members, preventing arbitrary PDF object injection.

• Fixed Version:4.1.0
• Patch Commit:GitHub Commit da291a5f01b96282545c9391996702cdb8879f79
• Release Notes:GitHub Release v4.1.0

Workarounds

• Implement strict input validation before passing any user data to Acroform methods
• Use allowlist-based validation for addOption, setOptions, and appearanceState inputs
• Remove or sanitize special characters that could enable PDF object injection
• Consider using alternative PDF form generation methods until patching is complete

# Update jsPDF to patched version
npm update jspdf@4.1.0

# Or specify the exact version in package.json
npm install jspdf@^4.1.0 --save