CVE-2026-24737
📋 TL;DR
This vulnerability in jsPDF allows attackers to inject arbitrary PDF objects, including JavaScript actions, through user-controlled input to specific Acroform module methods and properties. When a victim opens a malicious PDF document, the injected JavaScript executes in their PDF viewer context. This affects any application using jsPDF versions before 4.1.0 that allows user input to reach the vulnerable API members.
💻 Affected Systems
- jsPDF
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of victim's system through arbitrary code execution when opening a malicious PDF, potentially leading to data theft, ransomware deployment, or system takeover.
Likely Case
Cross-site scripting (XSS) attacks, session hijacking, credential theft, or malicious redirects when PDFs are opened in web applications.
If Mitigated
Limited impact with proper input validation and sanitization, potentially reduced to denial of service or minor data leakage.
🎯 Exploit Status
Exploitation requires user interaction (opening PDF) but is straightforward once malicious input reaches vulnerable methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.0
Vendor Advisory: https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328
Restart Required: No
Instructions:
1. Update jsPDF dependency to version 4.1.0 or later. 2. For npm: 'npm update jspdf'. 3. For yarn: 'yarn upgrade jspdf'. 4. Verify package.json shows 'jspdf': '^4.1.0'.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all user inputs passed to AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState methods.
Disable Acroform Module
allIf Acroform functionality is not required, disable or avoid using the vulnerable Acroform module methods entirely.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs passed to vulnerable Acroform methods.
- Use Content Security Policy (CSP) headers to restrict script execution in PDF contexts.
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for jsPDF version. If version is below 4.1.0 and application uses Acroform module with user input, it's vulnerable.Check Version:
npm list jspdf | grep jspdfVerify Fix Applied:
Verify jsPDF version is 4.1.0 or higher in package.json and test that user input to Acroform methods no longer allows JavaScript injection.📡 Detection & Monitoring
Log Indicators:
- Unusual PDF generation patterns, unexpected JavaScript in PDF metadata, errors from PDF parsing libraries
Network Indicators:
- Unexpected PDF downloads containing JavaScript objects, suspicious file uploads to PDF generation endpoints
SIEM Query:
source="web_server" AND (uri="*.pdf" OR method="POST" AND uri="/generate-pdf") AND (user_agent="*malicious*" OR referer="*suspicious*")