CVE-2026-25755

Katalog CVE

CVSS 8.8 · High EPSS 0,82%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada parall jspdf. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp advisory vendor
• https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437 patch
• https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md exploit · mitigasi · advisory pihak ketiga
• https://github.com/parallax/jsPDF/releases/tag/v4.2.0 release notes
• https://access.redhat.com/errata/RHSA-2026:7110
• https://access.redhat.com/errata/RHSA-2026:7128
• https://access.redhat.com/security/cve/CVE-2026-25755
• https://bugzilla.redhat.com/show_bug.cgi?id=2440993
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25755.json