High severity · published Feb 19, 2026
CVE-2026-25940
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsPDF · parallax
< 4.2.0 · source: vendor, NVD
RH
Red Hat Advanced Cluster Security 4.8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Security 4.9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25940
Patch
https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375
Release Notes
https://github.com/parallax/jsPDF/releases/tag/v4.2.0
Vendor Advisory
https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:7110
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:7128
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-25940
More from jsPDF
8.8
CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
8.1
CVE-2026-24737
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
7.5
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
7.5
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability
6.5
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color