Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R C L L N 6.1 .0026 18.4 —
AFFECTED Product Versions Fixed jsPDF < 4.2.1 – —
TIMELINE Mar 10 Reserved by GitHub_M Mar 18 Published (CNA: GitHub_M) Aug 18 RESCORED — CVE-2026-31938 (parallax jsPDF). CVSS 9.6 → 6.1 (NVD).
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method.
| Date | Event | Detail |
|---|---|---|
| March 10, 2026 | Reserved | Reserved by GitHub_M |
| March 18, 2026 | Published | Published (CNA: GitHub_M) |
| August 18, 2026 | RESCORED | RESCORED — CVE-2026-31938 (parallax jsPDF). CVSS 9.6 → 6.1 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| parallax | jsPDF | — | < 4.2.1 | — |
Authoritative record: CVE-2026-31938 at cve.org
Vendors: parallax
Weaknesses: CWE-79
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-31938 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.