CVE-2026-24043: parall jspdf

csirt@kutim:~/threat-intel/cve/CVE-2026-24043

CVSS 5.4 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada parall jspdf. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.

Rincian

Terbit di NVD: 2 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
parall	jspdf	Semua versi sebelum 4.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422 exploit · mitigasi · advisory vendor
https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff patch
https://github.com/parallax/jsPDF/releases/tag/v4.1.0 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.