CVE-2026-24737: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24737 is a PDF injection vulnerability in the jsPDF Acroform module that allows attackers to inject arbitrary PDF objects, including JavaScript actions, into generated PDF documents. It affects jsPDF versions up to and including 4.0.0 (npm package) and was disclosed on February 2, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory). Downstream products from IBM — including Cloud Pak for Business Automation, IBM API Connect, and IBM Observability with Instana — are also affected due to their dependency on jsPDF (IBM Advisory).

The root cause is improper encoding or escaping of output (CWE-116) in the jsPDF Acroform module, where user-controlled input passed to certain API members is not properly sanitized before being embedded in the PDF structure. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. An attacker can craft a payload beginning with / to bypass the existing escaping logic, then use PDF syntax characters (e.g., ], <<, >>) to close existing arrays and inject arbitrary PDF dictionary entries such as /AA (Additional Actions) containing /JS JavaScript blocks. The fix introduced a pdfEscapeName() function that hex-encodes special PDF delimiter and whitespace characters, preventing structural injection (GitHub Advisory, Patch Commit).

When a victim opens a maliciously crafted PDF generated by a vulnerable jsPDF application, embedded JavaScript actions execute automatically within the PDF viewer context. This can result in high confidentiality and integrity impact — enabling credential theft, sensitive data exfiltration, or malware deployment — though availability is not directly affected. The attack requires no privileges from the attacker and no special configuration, but does require user interaction (opening the document). Applications that accept user-controlled input and pass it unsanitized to jsPDF Acroform APIs are the primary exposure point (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed as of the time of disclosure (Feedly). The GitHub security advisory references the attack vector with a working example payload, which lowers the bar for exploitation by knowledgeable actors. The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 5007328) (Feedly).

1. Identify a vulnerable application: Find a web application or service that uses jsPDF ≤ 4.0.0 and accepts user-controlled input that is passed to Acroform API members such as AcroformChoiceField.addOption or AcroFormCheckBox.appearanceState.
2. Craft the injection payload: Construct a string that starts with / to bypass the existing escaping check, then uses PDF syntax to close the current array and inject an Additional Action dictionary. Example: /dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage [
3. Submit the payload: Provide the crafted string as input to the vulnerable field (e.g., a form option or appearance state value) in the target application.
4. Trigger PDF generation: Cause the application to generate a PDF document incorporating the malicious input via jsPDF's Acroform module.
5. Deliver the PDF to the victim: Share or send the generated PDF to a target user via email, download link, or other means.
6. Achieve JavaScript execution: When the victim opens the PDF in a JavaScript-capable viewer (e.g., Adobe Acrobat), the injected /AA action triggers automatically (e.g., on field focus), executing the embedded JavaScript payload within the viewer context (GitHub Advisory).

• File System: PDF files generated by the application containing raw PDF syntax strings such as /AA <<, /S /JavaScript, or /JS ( within form field option arrays or appearance state values.
• Application Logs: Unexpected or malformed input strings containing /, ], <<, >>, /AA, /JS sequences submitted to form-generation endpoints that invoke jsPDF Acroform APIs.
• Network: Unusual outbound connections from a victim's PDF viewer process following the opening of an application-generated PDF document, potentially indicating JavaScript-triggered exfiltration.
• Process: Unexpected child processes or network activity spawned by PDF viewer applications (e.g., Adobe Acrobat, Foxit) after opening documents generated by the vulnerable application (GitHub Advisory).

The vulnerability is fixed in jsPDF version 4.1.0, which introduces proper hex-encoding of PDF Name Object special characters via a new pdfEscapeName() function (jsPDF Release, Patch Commit). As an immediate workaround prior to upgrading, developers should sanitize all user-controlled input before passing it to the vulnerable API members (addOption, setOptions, appearanceState), applying allowlist-based validation to reject PDF syntax characters. IBM has released iFixes for affected products including Cloud Pak for Business Automation (April 2026), IBM API Connect, and IBM Observability with Instana (IBM CP4BA, IBM API Connect).

The vulnerability was reported and fixed by researcher Ahmet Artuç, who is credited in the GitHub security advisory (GitHub Advisory). Security news outlet SecurityOnline.info covered the disclosure under the headline "PDF Poison: Popular JavaScript Library Patches Critical Injection and Crash Flaws" (SecurityOnline). TheHackerWire also reported on the vulnerability and shared it via Bluesky and Mastodon social channels, indicating moderate community awareness.