CVE-2026-25940 describes a critical vulnerability in jsPDF versions prior to 4.2.0, a JavaScript library for PDF generation. This flaw allows attackers to inject arbitrary PDF objects, including malicious JavaScript actions, if unsanitized user input is passed to specific Acroform module properties. The vulnerability carries a CVSS score of 8.1 (HIGH), indicating a network-based attack with low complexity, requiring user interaction, and leading to high impact on confidentiality and integrity. While no public exploit code or active exploitation has been observed, and community discussion is minimal, organizations using affected jsPDF versions should upgrade to 4.2.0 or implement robust input sanitization to mitigate the risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.2.0CPE matchmatch criteria | cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
Feb 19, 2026jsPDF: PDF injection in AcroForm module allows arbitrary JavaScript execution (RadioButton children)
Feb 19, 2026