survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

Description

The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.

Recommendation

Update the survey-pdf package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, <= 2.5.4

  <= 1.12.58**

• Patched version(s): **2.5.5

  1.12.59**

References

• GHSA-h3q6-jfrg-3x6q
• CVE-2026-25630
• CWE-35
• CWE-73
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• jsPDF has a PDF Object Injection via FreeText color - CVE-2026-31898
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
• jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution - CVE-2026-24737
• jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" pr - CVE-2026-25940

Tags:

npm

survey-pdf