Medium severity · published Feb 2, 2026
CVE-2026-24043
jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsPDF · parallax
< 4.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24043
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24043
Patch
https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff
Release Notes
https://github.com/parallax/jsPDF/releases/tag/v4.1.0
Exploit
https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422
More from jsPDF
8.8
CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
8.1
CVE-2026-25940
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
8.1
CVE-2026-24737
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
7.5
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
7.5
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability