CVE-2026-31898: jsPDF Library XSS Vulnerability

CVE-2026-31898 Overview

CVE-2026-31898 is a PDF Object Injection vulnerability in jsPDF, a popular JavaScript library used to generate PDF documents in client-side and server-side JavaScript applications. Prior to version 4.2.1, the createAnnotation method is vulnerable to arbitrary PDF object injection through unsanitized user input in the color parameter. This allows attackers to inject malicious JavaScript actions into generated PDF documents that execute when the PDF is opened or when users interact with annotated elements.

Critical Impact
Attackers can inject arbitrary PDF JavaScript actions through the vulnerable createAnnotation method, potentially executing malicious code when victims open compromised PDF documents. This can lead to data theft, phishing attacks, or further exploitation of the user's system.

Affected Products

jsPDF versions prior to 4.2.1
Applications using the createAnnotation API with unsanitized user input
Web applications generating PDFs with user-controlled annotation parameters

Discovery Timeline

2026-03-18 - CVE CVE-2026-31898 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-31898

Vulnerability Analysis

This vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output), which occurs when the application fails to properly sanitize user-controlled input before including it in PDF output structures. The createAnnotation method in jsPDF constructs PDF annotation objects by directly incorporating user-supplied values, specifically the color parameter, without adequate validation or encoding.

When generating FreeText annotations, the vulnerable code path allows specially crafted input in the color parameter to break out of the intended context and inject arbitrary PDF objects. PDF format supports embedded JavaScript through action objects, and attackers can leverage this injection point to include malicious /JS (JavaScript) actions that execute automatically when the PDF is opened or when users interact with the annotation.

The attack is network-exploitable and requires user interaction—specifically, the victim must open the malicious PDF document. Once opened, the injected JavaScript executes within the PDF reader's JavaScript context, which could lead to information disclosure or serve as a vector for social engineering attacks.

Root Cause

The root cause lies in improper output encoding when constructing PDF annotation objects in the src/modules/annotations.js file. The color parameter from user input is concatenated directly into PDF object strings without proper escaping or validation, allowing attackers to inject additional PDF syntax and objects beyond the intended color value.

Attack Vector

An attacker can exploit this vulnerability by providing a maliciously crafted color value to the createAnnotation method. The injected payload can include PDF object syntax that terminates the color attribute and introduces arbitrary PDF structures, such as JavaScript action objects (/S /JavaScript /JS). When the generated PDF is opened by a victim, any injected JavaScript will execute within the PDF reader's scripting environment.

The attack is delivered through the network (AV:N) and requires no special privileges (PR:N), but does require user interaction (UI:R) as the victim must open the malicious PDF. Successful exploitation can result in high confidentiality (C:H) and integrity (I:H) impacts.

javascript

               getVerticalCoordinateString(anno.bounds.y + anno.bounds.h) +
               "] ";
             var color = anno.color || "#000000";
+            var defaultStyle =
+              "font: Helvetica,sans-serif 12.0pt; text-align:left; color:#" +
+              color;
             line =
               "<</Type /Annot /Subtype /" +
               "FreeText" +

Source: jsPDF Commit History

Detection Methods for CVE-2026-31898

Indicators of Compromise

PDF documents containing unexpected JavaScript actions within annotation objects
Anomalous PDF structure with JavaScript (/JS) or action (/S /JavaScript) objects embedded in annotations
Generated PDFs with malformed or suspicious color values containing PDF syntax characters

Detection Strategies

Scan application dependencies for jsPDF versions prior to 4.2.1 using software composition analysis (SCA) tools
Monitor PDF generation logs for annotation requests with unusual color parameter values containing special characters like >>, /, or <<
Implement output inspection for generated PDFs to detect embedded JavaScript actions
Review application code for calls to createAnnotation that pass user-controlled data without sanitization

Monitoring Recommendations

Implement application-level logging for all createAnnotation API calls with parameter values
Configure web application firewalls to detect PDF injection patterns in request parameters
Enable PDF content scanning on email gateways and file storage systems to detect malicious JavaScript in PDF documents

How to Mitigate CVE-2026-31898

Immediate Actions Required

Upgrade jsPDF to version 4.2.1 or later immediately
Audit application code for any usage of the createAnnotation method with user-controlled input
Implement input validation and sanitization for all data passed to jsPDF annotation methods
Review and quarantine any PDFs generated with potentially malicious input while using vulnerable versions

Patch Information

The vulnerability has been fixed in jsPDF version 4.2.1. The security patch properly handles the color parameter to prevent PDF object injection. Organizations should update their jsPDF dependency to the patched version. For more details, refer to the GitHub Security Advisory GHSA-7x6v-j9x4-qf24 and the jsPDF Release v4.2.1.

Workarounds

Sanitize all user input before passing to the createAnnotation method by removing or encoding special PDF syntax characters
Implement allowlist validation for color values, accepting only valid hexadecimal color codes (e.g., /^#[0-9A-Fa-f]{6}$/)
Disable or restrict the createAnnotation functionality if not required by the application until patching is possible

bash

# Configuration example
# Update jsPDF to patched version using npm
npm update jspdf@4.2.1

# Or install specifically
npm install jspdf@4.2.1 --save

# Verify installed version
npm list jspdf