Login Request a demo
JS
Product
jsPDF
by parallax · last CVE Mar 18, 2026
11
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 6Medium 5Low 0
Severity
All severities11Critical0High6Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jsPDF to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25755
8.8
1%
Feb 19
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
Affected: < 4.2.0
CVE-2026-25940
8.1
0%
Feb 19
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
Affected: < 4.2.0
CVE-2026-24737
8.1
1%
Feb 2
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
Affected: < 4.1.0
CVE-2026-25535
7.5
1%
Feb 19
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
Affected: < 4.2.0
CVE-2025-68428
7.5
2%
Jan 5
jsPDF has Local File Inclusion/Path Traversal vulnerability
Affected: < 4.0.0
CVE-2025-57810
7.5
1%
Aug 26
jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)
Affected: < 3.0.2
CVE-2026-31898
6.5
0%
Mar 18
jsPDF has a PDF Object Injection via FreeText color
Affected: < 4.2.1
CVE-2026-24133
6.5
1%
Feb 2
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Affected: < 4.1.0
CVE-2026-31938
6.1
0%
Mar 18
jsPDF has HTML Injection in New Window paths
Affected: < 4.2.1
CVE-2026-24043
5.4
0%
Feb 2
jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Affected: < 4.1.0
CVE-2026-24040
4.8
0%
Feb 2
jsPDF has a Shared State Race Condition in addJS Plugin
Affected: < 4.1.0
Showing 11