CVE-2026-25940: jsPDF Acroform XSS Vulnerability

CVE-2026-25940 Overview

CVE-2026-25940 is a high-severity injection vulnerability affecting jsPDF, a popular JavaScript library used to generate PDF documents in web applications. Prior to version 4.2.0, the library's Acroform module fails to properly sanitize user-controlled input, allowing attackers to inject arbitrary PDF objects, including malicious JavaScript actions that execute when a victim interacts with certain PDF elements.

This vulnerability falls under CWE-116 (Improper Encoding or Escaping of Output), where the application fails to properly neutralize special elements before passing them to downstream components.

Critical Impact

Attackers can inject arbitrary JavaScript actions into generated PDFs that execute when victims hover over form elements such as radio options, potentially leading to credential theft, data exfiltration, or further exploitation.

Affected Products

• jsPDF versions prior to 4.2.0
• Applications using jsPDF Acroform module with unsanitized user input
• Web applications generating PDFs with user-controlled form fields

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-25940 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25940

Vulnerability Analysis

The vulnerability exists in jsPDF's Acroform module, which is responsible for generating interactive PDF form elements. The module accepts user-controlled properties and methods that are directly incorporated into the PDF document structure without proper sanitization or encoding.

When an attacker can control input passed to vulnerable Acroform API members, they can craft malicious input that escapes the intended context and injects arbitrary PDF objects. This includes the ability to inject JavaScript actions that are associated with form elements. The injected JavaScript executes within the PDF viewer's JavaScript engine when the victim interacts with the malicious form elements, such as hovering over a radio button option.

The attack requires user interaction (hovering over the compromised form element), but once triggered, the malicious JavaScript has access to the PDF viewer's JavaScript API, which can vary in capability depending on the viewer application used.

Root Cause

The root cause is improper encoding or escaping of output (CWE-116) within the Acroform module. The vulnerable code paths accept user-controlled properties and incorporate them directly into PDF object definitions without neutralizing special characters or validating that the input conforms to expected formats. This allows attackers to break out of the intended data context and inject additional PDF objects or actions.

Attack Vector

The attack vector is network-based, requiring an attacker to supply malicious input to an application that uses jsPDF with the Acroform module. The attack scenario involves:

1. An attacker identifies a web application that generates PDFs using jsPDF and accepts user input for form fields
2. The attacker crafts malicious input containing PDF object injection payloads targeting Acroform properties
3. The application generates a PDF with the injected malicious JavaScript action
4. When a victim opens the PDF and hovers over the affected form element (such as a radio option), the injected JavaScript executes

The vulnerability requires no authentication to exploit but does require user interaction to trigger the malicious payload. Successful exploitation can result in high impacts to confidentiality and integrity, as the attacker-controlled JavaScript can access data within the PDF and potentially interact with the PDF viewer's environment.

For detailed technical information about the vulnerability mechanism and specific affected API members, refer to the GitHub Security Advisory GHSA-p5xg-68wr-hm3m.

Detection Methods for CVE-2026-25940

Indicators of Compromise

• PDF documents containing unexpected JavaScript actions associated with form elements
• Suspicious user input patterns containing PDF object syntax characters in form-related API calls
• Anomalous PDF structure with injected objects in Acroform sections
• User reports of unexpected behavior when interacting with PDF form elements

Detection Strategies

• Implement input validation logging to identify injection attempts targeting jsPDF Acroform properties
• Scan generated PDF files for unauthorized JavaScript actions or unexpected object injections
• Monitor application logs for unusual characters or escape sequences in form field inputs
• Deploy static analysis tools to identify code paths passing unsanitized input to vulnerable jsPDF APIs

Monitoring Recommendations

• Audit all code paths where user input flows into jsPDF Acroform module methods
• Review generated PDFs periodically for unexpected embedded JavaScript
• Implement Content Security Policy headers for applications serving generated PDFs
• Monitor for security advisories related to jsPDF and dependent libraries

How to Mitigate CVE-2026-25940

Immediate Actions Required

• Upgrade jsPDF to version 4.2.0 or later immediately
• Audit all application code for usage of jsPDF Acroform module with user-controlled input
• Implement input sanitization as a defense-in-depth measure for all user input passed to PDF generation functions
• Review previously generated PDFs for potential compromise if user input was accepted

Patch Information

The vulnerability has been fixed in jsPDF version 4.2.0. The patch addresses the improper output encoding issue in the Acroform module, preventing injection of arbitrary PDF objects through user-controlled properties.

Patch details are available in the GitHub Commit Update. The fixed version can be obtained from the GitHub Release v4.2.0.

Workarounds

• Sanitize all user input before passing it to vulnerable Acroform API members
• Strip or encode special PDF object characters from user-controlled strings
• Implement an allowlist approach for acceptable characters in form field properties
• Consider disabling Acroform functionality if interactive forms are not required

# Example: Update jsPDF using npm
npm update jspdf@4.2.0

# Verify installed version
npm list jspdf