CVE-2026-24043: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24043 is an XML/XMP metadata injection vulnerability in the jsPDF JavaScript library, specifically in the addMetadata function, that allows users to inject arbitrary XML into generated PDF documents. It affects jsPDF versions up to and including 4.0.0 (npm package) and was disclosed on February 2, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v4.0 base score of 6.9 (Medium) and a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla). Downstream products including IBM Cloud Pak for Business Automation, IBM Instana Observability, and IBM API Connect are also affected as they bundle the vulnerable library (IBM Advisory).

The root cause is improper input validation (CWE-20) and improper neutralization of special elements in output used by a downstream component (CWE-74, CWE-91) in the addMetadata function within src/modules/xmp_metadata.js. User-supplied input passed as the first argument to addMetadata was embedded directly into the PDF's XMP metadata XML block without escaping XML special characters (<, >, &, ", '), enabling an attacker to break out of the current XML element context and inject arbitrary XMP tags. The fix in commit efe54bf introduced an escapeXml() function that sanitizes metadata before embedding it, and added an explicit rawXml boolean flag for intentional raw XML inclusion (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker with the ability to supply input to the addMetadata function to inject arbitrary XMP metadata into generated PDFs, including spoofing document properties such as the dc:creator (author) field to impersonate trusted identities. If the tampered PDF is subsequently signed, stored, or processed by downstream systems, the integrity of the document can no longer be guaranteed, potentially enabling document fraud or trust chain compromise. There is no direct confidentiality or availability impact; the primary risk is integrity violation and identity spoofing within PDF documents (GitHub Advisory).

A proof-of-concept exploit is publicly available via the GitHub Security Advisory, demonstrating the injection technique with a crafted metadata string that closes existing XML tags and injects new ones (GitHub Advisory). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.019% per GitHub Advisory), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Identify a vulnerable application: Locate a web application or service that uses jsPDF version ≤ 4.0.0 and exposes user-controlled input that is passed to the addMetadata() function without prior sanitization.
2. Craft a malicious metadata payload: Construct a string that closes the current XML element context and injects new XMP metadata elements. For example:

const maliciousInput = '</jspdf:metadata></rdf:Description>' +
    '<rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/">' +
    '<dc:creator>TRUSTED_ADMINISTRATOR</dc:creator>' +
    '</rdf:Description>' +
    '<rdf:Description><jspdf:metadata>';

3. Submit the payload: Provide the crafted string as input to the application at the point where it is passed to doc.addMetadata(maliciousInput, "http://valid.namespace").
4. Trigger PDF generation: Cause the application to generate and save the PDF (e.g., doc.save("output.pdf")).
5. Verify injection: Open the generated PDF and inspect its XMP metadata (e.g., using a PDF metadata viewer or exiftool) to confirm the injected dc:creator or other spoofed fields are present.
6. Leverage the tampered PDF: Distribute or submit the PDF to downstream systems (e.g., document signing services, archival systems) where the spoofed metadata may be trusted, enabling identity spoofing or integrity violations (GitHub Advisory).

• File System: Generated PDF files containing unexpected or anomalous XMP metadata fields (e.g., dc:creator values set to privileged identities not matching the actual document author); presence of malformed or duplicate RDF/XMP blocks within PDF metadata streams.
• Logs: Application logs showing unusual or oversized metadata strings submitted to PDF generation endpoints; input fields containing XML special characters (<, >, &) in metadata-related parameters.
• Network: HTTP requests to PDF generation endpoints containing URL-encoded or raw XML tags (%3C, %3E, </, <rdf:) in metadata input fields.

Upgrade jsPDF to version 4.1.0 or later, which introduces XML escaping via the escapeXml() function applied to all metadata before embedding (jsPDF v4.1.0 Release, GitHub Commit). As a workaround for applications that cannot immediately upgrade, sanitize all user-supplied input before passing it to addMetadata by escaping XML entities (&, <, >, ", ') (GitHub Advisory). IBM has released iFixes for affected products including Cloud Pak for Business Automation (April 2026), IBM Instana Observability, and IBM API Connect (IBM Advisory).

The vulnerability was reported by security researcher KarimTantawey and published by HackbrettXXX via the jsPDF GitHub Security Advisory on February 2, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2436149) and assessed it as medium severity (Red Hat Bugzilla). The vulnerability received routine coverage from automated vulnerability feeds and aggregators; no significant broader community debate or media coverage has been identified.