CVE-2026-25940: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25940 is a PDF injection vulnerability in the jsPDF Acroform module that allows arbitrary JavaScript execution via unsanitized user input. Discovered and disclosed on February 19, 2026, it affects all jsPDF versions prior to 4.2.0 (≤4.1.0). The flaw enables attackers to inject arbitrary PDF objects — including JavaScript actions — that execute when a victim interacts with PDF form elements such as radio buttons. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper encoding or escaping of output (CWE-116) in the jsPDF Acroform module's AcroformChildClass.appearanceState property setter, which previously assigned user-supplied values directly without sanitization. An attacker who can supply unsanitized input to this property can embed raw PDF syntax — including /AA << /E << /S /JavaScript /JS (...) >> >> action dictionaries — directly into the generated PDF structure. The fix in commit 71ad2db wraps all setter assignments through pdfEscapeName(), which percent-encodes special characters (e.g., / becomes #2F), preventing injection of additional PDF objects (GitHub Advisory, Fix Commit). Exploitation requires no privileges but does require user interaction (the victim must open or hover over the crafted PDF).

Successful exploitation allows an attacker to inject malicious JavaScript that executes within the victim's PDF reader when they interact with form elements (e.g., hovering over a radio button option). This can result in high confidentiality impact (e.g., data exfiltration via PDF JavaScript APIs) and high integrity impact (e.g., modification of PDF content or triggering further actions), with no direct availability impact. Downstream IBM products incorporating jsPDF — including IBM API Connect, IBM Cloud Pak for Business Automation, IBM Instana Observability, IBM InfoSphere Optim Archive Viewer, and Cloudera Data Platform with IBM — are also affected (GitHub Advisory, IBM Advisory).

A public proof-of-concept exploit is available on GitHub at https://github.com/dajneem23/CVE-2026-25940, added approximately March 2, 2026, and has also been indexed by Sploitus (Feedly). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029–0.042%, placing it in the lower percentiles for near-term exploitation probability (GitHub Advisory).

1. Identify a vulnerable application: Find a web application or service that uses jsPDF ≤4.1.0 and allows user-controlled input to be passed to the Acroform module's AcroformChildClass.appearanceState property (e.g., a PDF form generator that accepts user-supplied field values).
2. Craft a malicious payload: Prepare an injection string that breaks out of the expected PDF name value and appends a JavaScript action dictionary, for example: Off /AA << /E << /S /JavaScript /JS (app.alert('XSS')) >> >>.
3. Inject via the vulnerable property: Supply the payload as the appearanceState (or AS) value of a RadioButton child option created via group.createOption(), as shown in the advisory's example attack vector.
4. Generate and deliver the PDF: Trigger the application to generate and save the PDF (e.g., doc.save('malicious.pdf')), then deliver the resulting file to the victim via email, download link, or embedded viewer.
5. Trigger execution: When the victim opens the PDF in a JavaScript-capable PDF reader and hovers over the injected radio button option, the embedded JavaScript action executes within the PDF reader's JavaScript engine (GitHub Advisory, jsPDF Security Advisory).

• File System: Generated PDF files containing raw PDF syntax strings such as /AA <<, /S /JavaScript, or /JS ( within AcroForm field definitions — particularly in AS or appearanceState values that should only contain simple name tokens.
• Application Logs: Server-side logs showing user-supplied input containing PDF special characters (/, <<, >>) being passed to jsPDF Acroform API calls without sanitization.
• Network: Unexpected outbound network connections from a PDF reader process after opening a jsPDF-generated document, which may indicate JavaScript-triggered data exfiltration.
• Process: PDF reader processes (e.g., Adobe Acrobat, Foxit) spawning unexpected child processes or making unusual network requests shortly after a user opens a jsPDF-generated PDF containing AcroForm radio button fields.

The vulnerability is fixed in jsPDF version 4.2.0, released February 19, 2026, which applies pdfEscapeName() to all AS/appearanceState property setters in the Acroform module (jsPDF Release, Fix Commit). Organizations should upgrade immediately via npm install jspdf@4.2.0 or later. As a temporary workaround if patching is not immediately possible, sanitize all user-controlled input before passing it to any jsPDF Acroform API members, ensuring values contain only valid PDF name characters. IBM has released patches for affected products including API Connect, Cloud Pak for Business Automation, Instana Observability, and InfoSphere Optim Archive Viewer (IBM Advisory).

The vulnerability was reported by researcher "Macabely" and published by "HackbrettXXX" via the GitHub Security Advisory program on February 19, 2026 (jsPDF Security Advisory). The disclosure received coverage from automated vulnerability tracking services including TheHackerWire (Mastodon and Bluesky posts) and various CVE aggregators shortly after publication. Red Hat tracked the issue via Bugzilla (Bug 2441016) with a high severity rating, and IBM issued multiple security bulletins for affected downstream products through May 2026 (Red Hat Bugzilla, IBM Advisory).