parallax jsPDF vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202610

Newest CVEs

• CVE-2026-31938

  jsPDF has HTML Injection in New Window paths

  parallax · jsPDF

  Critical9.6
• CVE-2026-31898

  jsPDF has a PDF Object Injection via FreeText color

  parallax · jsPDF

  High8.1
• CVE-2026-25940

  jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

  parallax · jsPDF

  High8.1
• CVE-2026-25755

  jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

  parallax · jsPDF

  High8.1
• CVE-2026-25535

  jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

  parallax · jsPDF

  High8.7
• CVE-2026-24040

  jsPDF has a Shared State Race Condition in addJS Plugin

  parallax · jsPDF

  Medium6.3
• CVE-2026-24043

  jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

  parallax · jsPDF

  Medium6.9
• CVE-2026-24133

  jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

  parallax · jsPDF

  High8.7
• CVE-2026-24737

  jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

  parallax · jsPDF

  High8.1
• CVE-2025-68428

  jsPDF has Local File Inclusion/Path Traversal vulnerability

  parallax · jsPDF

  Critical9.2