Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M

CVE-2026-24043jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Medium 6.9

In plain English

A medium-severity injection in jsPDF from parallax. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	jspdf	4.1.0	GHSA-vm32-vv63-w422

Affected products (as reported)

Vendor	Product	Versions
parallax	jsPDF	< 4.1.0

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422 x_refsource_CONFIRM
https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff x_refsource_MISC
https://github.com/parallax/jsPDF/releases/tag/v4.1.0 x_refsource_MISC