CVE-2026-24043

MEDIUM

5.4

Descricao

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado2/2/2026

Ultima modificacao2/18/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

parall:jspdf

Fraquezas (CWE)

CWE-74

Referencias

https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff(security-advisories@github.com)

https://github.com/parallax/jsPDF/releases/tag/v4.1.0(security-advisories@github.com)

https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.