VendorsParalljspdfany version

Vulnerabilities

Parall ax jsPDF any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

15CVEs

jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

Published 2026-02-19 · Modified

9.6EPSS 0.008

jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

Published 2026-02-19 · Modified

9.6EPSS 0.006

jsPDF has HTML Injection in New Window paths

Published 2026-03-18 · Modified

9.6EPSS 0.004

jsPDF has Local File Inclusion/Path Traversal vulnerability

Published 2026-01-05 · Modified

9.2EPSS 0.022

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Published 2026-02-19 · Modified

8.7EPSS 0.009

jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

Published 2025-08-26 · Analyzed

8.7EPSS 0.007

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

Published 2025-03-18 · Analyzed

8.7EPSS 0.007

jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

Published 2026-02-02 · Analyzed

8.7EPSS 0.006

jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

Published 2026-02-02 · Modified

8.3EPSS 0.005

jsPDF has a PDF Object Injection via FreeText color

Published 2026-03-18 · Modified

8.1EPSS 0.006

Regular Expression Denial of Service (ReDoS)

Published 2021-03-09 · Modified

7.5EPSS 0.026

jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Published 2026-02-02 · Analyzed

6.9EPSS 0.003

Cross-site Scripting (XSS)

Published 2020-07-06 · Modified

6.3EPSS 0.016

jsPDF has a Shared State Race Condition in addJS Plugin

Published 2026-02-02 · Analyzed

6.3EPSS 0.003

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

Published 2020-07-06 · Modified

6.1EPSS 0.010