jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

Description

User control of the first argument of the addMetadata function allows users to inject arbitrary XML.

If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.1.0

References

• GHSA-vm32-vv63-w422
• CVE-2026-24043
• CWE-20
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution - CVE-2026-24737
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• jsPDF has a PDF Object Injection via FreeText color - CVE-2026-31898

Tags:

npm

jspdf