CVE-2026-31938: Parall Jspdf XSS Vulnerability

CVE-2026-31938 Overview

CVE-2026-31938 is a Cross-Site Scripting (XSS) vulnerability in jsPDF, a popular JavaScript library used for generating PDF documents in browser and Node.js environments. Prior to version 4.2.1, user control of the options argument in the output function allows attackers to inject arbitrary HTML, including malicious scripts, into the browser context where the generated PDF is opened.

Critical Impact

Attackers can inject scripts that execute in the victim's browser context, potentially extracting or modifying sensitive data, session tokens, or performing actions on behalf of the user.

Affected Products

• Parall jsPDF versions prior to 4.2.1
• Applications using jsPDF for client-side PDF generation with user-controlled output options
• Node.js applications using jsPDF (cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*)

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-31938 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-31938

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Cross-Site Scripting), specifically a reflected XSS attack vector that exploits improper input sanitization in the jsPDF library's output function. The attack requires user interaction, as the victim must open a PDF generated with malicious options in their browser.

The vulnerability arises when applications pass user-controlled data directly to the output method without proper sanitization. Since jsPDF generates content that can be rendered in browser contexts, unsanitized options can lead to HTML/script injection that executes when the PDF is viewed.

Root Cause

The root cause is insufficient input validation and sanitization of the options argument passed to the output function. The library failed to properly escape or validate user-provided configuration values before incorporating them into generated content, allowing arbitrary HTML and JavaScript to be injected into the output context.

Attack Vector

The attack vector operates through a network-based scenario requiring user interaction:

1. An attacker provides malicious values for the output options, typically through a web interface that allows PDF customization
2. These malicious values are passed unsanitized to the jsPDF output method
3. When the victim creates and opens the resulting PDF in their browser using one of the vulnerable method overloads, the injected script executes
4. The attacker's code runs in the victim's browser context with access to cookies, session tokens, and DOM content

The vulnerability exploits the trust relationship between the jsPDF library and the browser's rendering engine. When malicious HTML/script content is embedded through the options parameter, the browser treats it as legitimate content to be executed.

Detection Methods for CVE-2026-31938

Indicators of Compromise

• Unexpected JavaScript execution when opening locally-generated PDF files
• Unusual network requests originating from PDF viewing contexts
• Suspicious HTML tags or script elements in jsPDF output option values
• Anomalous behavior in applications that accept user input for PDF generation

Detection Strategies

• Monitor for script injection patterns in input fields related to PDF generation functionality
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Review application logs for unusual characters or HTML entities in PDF-related API calls
• Perform static code analysis to identify unsanitized user input flowing to jsPDF output calls

Monitoring Recommendations

• Enable browser developer tools to monitor for unexpected script execution during PDF operations
• Implement server-side logging for all user-provided PDF generation parameters
• Deploy web application firewalls (WAF) with XSS detection rules for PDF generation endpoints
• Use SentinelOne's application-aware monitoring to detect anomalous browser behavior during PDF operations

How to Mitigate CVE-2026-31938

Immediate Actions Required

• Upgrade jsPDF to version 4.2.1 or later immediately
• Audit all code paths where user input is passed to jsPDF's output function
• Implement input sanitization for all user-controlled parameters before passing to jsPDF
• Deploy Content Security Policy headers to mitigate potential script injection impact

Patch Information

The vulnerability has been fixed in jsPDF version 4.2.1. The security patch is available through the GitHub Release v4.2.1. The specific fix can be reviewed in the GitHub Commit Reference.

For detailed information about the vulnerability and remediation, consult the GitHub Security Advisory GHSA-wfv2-pwc8-crg5.

Workarounds

• Sanitize all user input before passing it to the output method using HTML entity encoding
• Implement an allowlist of permitted option values rather than accepting arbitrary user input
• Avoid exposing PDF generation options directly to end users when possible
• Use server-side PDF generation with proper input validation as an alternative to client-side generation

# Update jsPDF to patched version via npm
npm update jspdf@4.2.1

# Or install specific patched version
npm install jspdf@4.2.1 --save