CVE-2026-31938 | Critical | 9.6 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to… |
CVE-2026-31898 | High | 8.1 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject ar… |
CVE-2026-25940 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2026-25755 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PD… |
CVE-2026-25535 | High | 7.5 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If… |
CVE-2026-24737 | High | 8.1 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2026-24133 | Medium | 6.5 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If g… |
CVE-2026-24043 | Medium | 5.4 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitr… |
CVE-2026-24040 | Medium | 4.8 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text)… |
CVE-2025-68428 | High | 7.5 | 2026-01-05 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allow… |
CVE-2025-57810 | High | 7.5 | 2025-08-26 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-29907 | High | 7.5 | 2025-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2021-23353 | Medium | 5.9 | 2021-03-09 | This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function. |
CVE-2020-7691 | Medium | 6.3 | 2020-07-06 | In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex. |
CVE-2020-7690 | Medium | 6.1 | 2020-07-06 | All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method. |