<section class="rounded-lg border border-[hsl(var(--border))] border-l-4 border-l-red-600 bg-[hsl(var(--background))] p-5"><div class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"><div class="min-w-0 flex-1 space-y-2"><h1 class="text-2xl font-bold font-mono break-all">CVE-2026-31938</h1><p class="text-lg leading-snug text-[hsl(var(--foreground))]">jsPDF has HTML Injection in New Window paths</p></div><div class="shrink-0 sm:text-right"><div class="text-5xl font-bold font-mono leading-none text-red-600">9.6</div><div class="mt-1 text-xs font-bold uppercase tracking-wide text-red-600">CRITICAL</div><div class="mt-0.5 text-[10px] uppercase tracking-wide text-[hsl(var(--muted-foreground))]">CVSS <!-- -->3.1</div></div></div><div class="mt-4 flex flex-wrap items-center gap-2"><span title="0.05% probability of exploitation in 30 days · top 83.9%" class="inline-flex items-center rounded px-1.5 py-0.5 text-[10px] font-bold uppercase tracking-wide font-mono bg-zinc-200 text-zinc-700 dark:bg-zinc-700 dark:text-zinc-200">EPSS 0.05%</span></div></section><div class="grid gap-6 lg:grid-cols-[1fr_280px]"><main class="min-w-0 space-y-6"><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-base font-semibold mb-3">Description</h2><p class="whitespace-pre-wrap leading-relaxed">### Impact User control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are: * `"pdfobjectnewwindow"`: the `pdfObjectUrl` option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string. * `"pdfjsnewwindow"`: the `pdfJsUrl` and `filename` options * `"dataurlnewwindow"`: the `filename` option The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. Example attack vector: ```js import { jsPDF } from 'jspdf'; const doc = new jsPDF(); const payload = 'x\"></iframe><script>window.__n=1</script><iframe src="'; doc.output('pdfjsnewwindow', { filename: payload, pdfJsUrl: 'viewer.html' }); ``` ### Patches The vulnerability has been fixed in jspdf@4.2.1. ### Workarounds Sanitize user input before passing it to the output method.</p></section><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-base font-semibold mb-3">How to fix CVE-2026-31938</h2><p class="leading-relaxed mb-3">To remediate CVE-2026-31938, upgrade the affected package to a fixed version below.</p><ul class="space-y-1.5 text-sm"><li class="flex flex-wrap items-baseline gap-2"><template id="P:4"></template><span class="text-[hsl(var(--muted-foreground))]">—</span><span>upgrade to 4.2.1 or later</span></li></ul></section><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-base font-semibold mb-3">Is CVE-2026-31938 being exploited?</h2><p class="leading-relaxed">Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.</p></section><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-base font-semibold mb-3">Affected packages (1)</h2><ul class="divide-y divide-[hsl(var(--border))] rounded-lg border border-[hsl(var(--border))]"><li class="flex flex-wrap items-center gap-2 px-4 py-3 hover:bg-[hsl(var(--muted))]"><template id="P:5"></template><span class="flex-1 min-w-0 text-sm text-[hsl(var(--muted-foreground))] font-mono">from 0, < 4.2.1</span><!--$!--><template data-dgst="BAILOUT_TO_CLIENT_SIDE_RENDERING"></template><!--/$--></li></ul></section><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><template id="P:6"></template><template id="P:7"></template></section><template id="P:8"></template></main><template id="P:9"></template></div></article></div><script>$RS=function(a,b){a=document.getElementById(a);b=document.getElementById(b);for(a.parentNode.removeChild(a);a.firstChild;)b.parentNode.insertBefore(a.firstChild,b);b.parentNode.removeChild(b)};$RS("S:2","P:2")</script><script>self.__next_f.push([1,"35:[\"$\",\"span\",null,{\"className\":\"w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]\",\"children\":\"WEB\"}]\n36:[\"$\",\"span\",null,{\"className\":\"min-w-0 flex-1 truncate text-sm\",\"children\":[[\"$\",\"span\",null,{\"className\":\"font-medium\",\"children\":\"github.com\"}],[\"$\",\"span\",null,{\"className\":\"text-[hsl(var(--muted-foreground))]\",\"children\":\"/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5\"}]]}]\n"])</script><div hidden id="S:6"><h2 class="text-base font-semibold mb-3">CVSS scores</h2></div><script>$RS("S:6","P:6")</script><div hidden id="S:7"><div class="overflow-x-auto"><table class="w-full text-sm"><thead class="text-xs uppercase tracking-wide text-[hsl(var(--muted-foreground))]"><tr><th class="text-left py-2 pr-3 font-medium">Source</th><th class="text-left py-2 pr-3 font-medium">Version</th><th class="text-left py-2 pr-3 font-medium">Severity</th><th class="text-left py-2 font-medium">Vector</th></tr></thead><tbody><tr class="border-t border-[hsl(var(--border))]"><td class="py-2 pr-3 font-mono text-xs">osv</td><td class="py-2 pr-3 font-mono text-xs whitespace-nowrap">CVSS <!-- -->3.1</td><td class="py-2 pr-3"><span class="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] font-bold uppercase tracking-wide bg-red-600 text-white">CRITICAL<span class="font-mono opacity-90">9.6</span></span></td><td class="py-2 font-mono text-xs break-all text-[hsl(var(--muted-foreground))]">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L</td></tr></tbody></table></div></div><script>$RS("S:7","P:7")</script><div hidden id="S:8"><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-base font-semibold mb-3">References (5)</h2><ul class="divide-y divide-[hsl(var(--border))] rounded-lg border border-[hsl(var(--border))]"><li class="hover:bg-[hsl(var(--muted))]"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-31938" target="_blank" rel="noreferrer noopener" class="flex items-baseline gap-3 px-4 py-2 no-underline" title="https://nvd.nist.gov/vuln/detail/CVE-2026-31938"><span class="w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]">ADVISORY</span><span class="min-w-0 flex-1 truncate text-sm"><span class="font-medium">nvd.nist.gov</span><span class="text-[hsl(var(--muted-foreground))]">/vuln/detail/CVE-2026-31938</span></span></a></li><li class="hover:bg-[hsl(var(--muted))]"><a href="https://github.com/parallax/jsPDF" target="_blank" rel="noreferrer noopener" class="flex items-baseline gap-3 px-4 py-2 no-underline" title="https://github.com/parallax/jsPDF"><span class="w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]">PATCH</span><span class="min-w-0 flex-1 truncate text-sm"><span class="font-medium">github.com</span><span class="text-[hsl(var(--muted-foreground))]">/parallax/jsPDF</span></span></a></li><li class="hover:bg-[hsl(var(--muted))]"><a href="https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7" target="_blank" rel="noreferrer noopener" class="flex items-baseline gap-3 px-4 py-2 no-underline" title="https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7"><span class="w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]">WEB</span><span class="min-w-0 flex-1 truncate text-sm"><span class="font-medium">github.com</span><span class="text-[hsl(var(--muted-foreground))]">/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7</span></span></a></li><li class="hover:bg-[hsl(var(--muted))]"><a href="https://github.com/parallax/jsPDF/releases/tag/v4.2.1" target="_blank" rel="noreferrer noopener" class="flex items-baseline gap-3 px-4 py-2 no-underline" title="https://github.com/parallax/jsPDF/releases/tag/v4.2.1"><span class="w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]">WEB</span><span class="min-w-0 flex-1 truncate text-sm"><span class="font-medium">github.com</span><span class="text-[hsl(var(--muted-foreground))]">/parallax/jsPDF/releases/tag/v4.2.1</span></span></a></li><li class="hover:bg-[hsl(var(--muted))]"><a href="https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5" target="_blank" rel="noreferrer noopener" class="flex items-baseline gap-3 px-4 py-2 no-underline" title="https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5"><span class="w-16 shrink-0 font-mono text-[10px] uppercase text-[hsl(var(--muted-foreground))]">WEB</span><span class="min-w-0 flex-1 truncate text-sm"><span class="font-medium">github.com</span><span class="text-[hsl(var(--muted-foreground))]">/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5</span></span></a></li></ul></section></div><script>$RS("S:8","P:8")</script><div hidden id="S:9"><aside class="space-y-6 lg:sticky lg:top-6 lg:self-start"><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-xs font-semibold uppercase tracking-wide text-[hsl(var(--muted-foreground))] mb-3">Metadata</h2><dl class="space-y-2 text-sm"><div class="flex justify-between gap-3"><dt class="text-[hsl(var(--muted-foreground))]">Published</dt><dd class="font-mono text-xs">3/17/2026</dd></div><div class="flex justify-between gap-3"><dt class="text-[hsl(var(--muted-foreground))]">Modified</dt><dd class="font-mono text-xs">3/19/2026</dd></div></dl></section><section class="rounded-lg border border-[hsl(var(--border))] bg-[hsl(var(--background))] p-5"><h2 class="text-xs font-semibold uppercase tracking-wide text-[hsl(var(--muted-foreground))] mb-3">Also known as:</h2><ul class="flex flex-col gap-1.5"><li><a href="https://github.com/advisories/GHSA-wfv2-pwc8-crg5" target="_blank" rel="noreferrer noopener" class="block rounded border border-[hsl(var(--border))] px-2 py-1 no-underline hover:bg-[hsl(var(--muted))]"><span class="flex items-baseline justify-between gap-2"><span class="font-mono text-sm break-all">GHSA-wfv2-pwc8-crg5</span><span class="shrink-0 text-[10px] uppercase tracking-wide text-[hsl(var(--muted-foreground))]">ghsa</span></span></a></li><li class="rounded border border-[hsl(var(--border))] px-2 py-1"><span class="flex items-baseline justify-between gap-2"><span class="font-mono text-sm break-all">CGA-gxcc-5r52-8xgw</span><span class="shrink-0 text-[10px] uppercase tracking-wide text-[hsl(var(--muted-foreground))]">other</span></span></li></ul></section></aside></div><script>$RS("S:9","P:9")</script><div hidden id="S:4"><a class="font-mono no-underline" href="/en/package/npm/jspdf"><span class="text-xs text-[hsl(var(--muted-foreground))]">npm<!-- -->/</span><span>jspdf</span></a></div><script>$RS("S:4","P:4")</script><div hidden id="S:5"><a class="no-underline font-medium" href="/en/package/npm/jspdf"><span class="font-mono text-xs text-[hsl(var(--muted-foreground))]">npm<!-- -->/</span><span class="font-mono">jspdf</span></a></div><script>$RS("S:5","P:5")</script><script>$RC("B:1","S:1")</script></body></html>