CVE-2026-25755: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25755 is a PDF Object Injection vulnerability in jsPDF, a widely used JavaScript library for generating PDF documents. The flaw exists in the addJS method, which fails to sanitize user-supplied input, allowing attackers to inject arbitrary PDF objects into generated documents by escaping JavaScript string delimiters. It affects all jsPDF versions prior to 4.2.0 (npm package jspdf). Disclosed on February 19, 2026, the vulnerability carries a CVSS v3.1 base score of 8.8 (High) per NVD, and 9.3 (Critical) per the GitHub Security Advisory (Github Advisory, Red Hat Bugzilla).

The root cause is improper output encoding (CWE-116) combined with code injection (CWE-94) in src/modules/javascript.js, where user-supplied input is concatenated directly into a PDF stream without escaping: this.internal.out("/JS (" + text + ")");. An attacker can craft a payload containing a closing parenthesis ) to prematurely terminate the PDF literal string, followed by >> to close the enclosing dictionary, and then inject arbitrary PDF objects such as /AA (Additional Actions) or /OpenAction entries. Critically, this technique bypasses the PDF JavaScript sandbox — injected objects like /OpenAction execute even when JavaScript is disabled in the PDF viewer, and affect lightweight viewers that process the PDF object hierarchy without a JS engine. A public PoC payload is: "console.log('test');) >> /AA << /O << /S /JavaScript /JS (app.alert('Hacked!')) >> >>" (Github Advisory, ZeroXJacks PoC).

Successful exploitation allows an attacker to inject malicious PDF objects into any document generated by a vulnerable jsPDF instance, impacting every user who opens the resulting PDF. The injected objects can execute arbitrary actions (e.g., app.alert, data exfiltration via form submission), manipulate document structure (injecting /Encrypt, /Signatures, /Annots), or perform UI redressing and phishing attacks. Because the attack leverages the PDF object hierarchy rather than JavaScript alone, it can affect users of mobile and embedded PDF viewers that lack a JS engine but still process PDF actions, broadening the attack surface significantly (ZeroXJacks PoC, Github Advisory).

Multiple public proof-of-concept exploits are available, including a detailed write-up by the original reporter ZeroXJacks and a separate PoC repository (absholi7ly/jsPDF-Object-Injection) (ZeroXJacks PoC, absholi7ly PoC). No confirmed in-the-wild exploitation has been reported as of the latest intelligence update. The EPSS score is approximately 0.032% (8th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been identified (Github Advisory).

1. Identify a vulnerable application: Find a web application or service that uses jsPDF versions prior to 4.2.0 and passes user-controlled input to the addJS method when generating PDFs.
2. Craft the injection payload: Construct a string that closes the PDF JavaScript literal string and injects a malicious PDF object. Example payload:

console.log('test');) >> /AA << /O << /S /JavaScript /JS (app.alert('Hacked!')) >> >>

The ) closes the /JS string, >> closes the enclosing dictionary, and /AA << ... >> injects an Additional Action. 3. Deliver the payload: Submit the crafted string through any application input field that is passed to doc.addJS() — such as a form field, API parameter, or document metadata field. 4. Generate and distribute the PDF: Trigger the PDF generation process so the malicious payload is embedded in the output document. The attacker may need to download or receive the generated PDF, or the application may automatically distribute it to other users. 5. Victim opens the PDF: When any user opens the generated PDF in a viewer (including those with JavaScript disabled), the injected PDF action (e.g., /OpenAction, /AA) executes, triggering the malicious behavior such as an alert, data exfiltration, or document structure manipulation (ZeroXJacks PoC, Github Advisory).

• File System: Generated PDF files containing raw PDF dictionary injection patterns such as >> /AA <<, /OpenAction, /S /JavaScript, or /JS ( outside of expected document structure; unexpected PDF files with embedded app.alert, app.launchURL, or similar AcroJS calls in non-standard object positions.
• Logs: Application logs showing unusual or oversized input submitted to PDF generation endpoints; inputs containing ), >>, /AA, /OpenAction, or /S /JavaScript in fields expected to contain JavaScript code.
• Network: Outbound HTTP/HTTPS requests originating from PDF viewer processes (e.g., Adobe Acrobat, Foxit) to unexpected external hosts, which may indicate data exfiltration via injected PDF actions such as app.launchURL or form submission actions.
• Process: PDF viewer processes spawning unexpected child processes or making unusual network connections after opening a jsPDF-generated document.

Upgrade jsPDF to version 4.2.0 or later, which introduces an escapeParens() function in src/modules/javascript.js that properly escapes unescaped parentheses in user-supplied input before embedding it in the PDF stream (jsPDF Commit). As an interim workaround for applications that cannot immediately upgrade, escape all parentheses (( and )) and backslashes in user-provided JavaScript strings before passing them to the addJS method. IBM has released patches for affected products including IBM API Connect, IBM Cloud Pak for Business Automation, IBM Observability with Instana (OnPrem), IBM InfoSphere Optim Archive Viewer, and Cloudera Data Platform Private Cloud Base with IBM — administrators of these products should apply the relevant IBM security bulletins (IBM API Connect Bulletin, IBM InfoSphere Bulletin).

The vulnerability received notable coverage from security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and The Hacker News (weekly recap), with headlines emphasizing the risk to "millions of developers" given jsPDF's widespread use (31k+ GitHub stars) (GBHackers, SecurityOnline, The Hacker News). The SANS Internet Storm Center discussed the vulnerability in a podcast episode, and social media accounts including @CVEnew and @the_yellow_fall on X (Twitter) highlighted the issue. The security community noted the particularly dangerous aspect that injected PDF objects can execute even with JavaScript disabled in PDF viewers, bypassing a common security control (ZeroXJacks PoC).