Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
parallax jsPDF — jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R U H H H 8.8 .0083 54.9 —
AFFECTED
Product Versions Fixed
jsPDF < 4.2.0 – —
TIMELINE
Feb 5 Reserved by GitHub_M
Feb 19 Published (CNA: GitHub_M)
Aug 18 EXPLOIT PUBLISHED — CVE-2026-25755 (parallax jsPDF). Public exploit reference added.
Aug 18 RESCORED — CVE-2026-25755 (parallax jsPDF). CVSS 8.1 → 8.8 (NVD).
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| February 5, 2026 | Reserved | Reserved by GitHub_M |
| February 19, 2026 | Published | Published (CNA: GitHub_M) |
| August 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-25755 (parallax jsPDF). Public exploit reference added. |
| August 18, 2026 | RESCORED | RESCORED — CVE-2026-25755 (parallax jsPDF). CVSS 8.1 → 8.8 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| parallax | jsPDF | — | < 4.2.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-25755 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.