High severity · published Feb 2, 2026
CVE-2026-24737
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsPDF · parallax
< 4.1.0 · source: vendor, NVD
RH
Red Hat Advanced Cluster Security 4.8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Security 4.9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24737
Patch
https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79
Release Notes
https://github.com/parallax/jsPDF/releases/tag/v4.1.0
Exploit
https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:4466
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:4467
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-24737
More from jsPDF
8.8
CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
8.1
CVE-2026-25940
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
7.5
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
7.5
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability
6.5
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color