CVE-2026-31898: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31898 is a PDF object injection vulnerability in the jsPDF JavaScript library, specifically in the createAnnotation method's color parameter, which allows attackers to inject arbitrary PDF objects including JavaScript actions. It affects jsPDF versions up to and including 4.2.0 (npm package). The vulnerability was discovered by researcher sofianeelhor, published via GitHub Security Advisory GHSA-7x6v-j9x4-qf24 on March 17, 2026, and assigned a CVSS v3.1 base score of 8.1 (High) by the GitHub Advisory Database (GitHub Advisory). Downstream products including IBM API Connect and Cloudera Data Platform Private Cloud Base are also affected (Feedly).

The root cause is improper encoding or escaping of output (CWE-116) combined with code injection (CWE-94): the color parameter passed to createAnnotation in src/modules/annotations.js (lines 193–208) is interpolated directly into the PDF document stream without sanitization, allowing an attacker to break out of the expected string context and inject arbitrary PDF syntax (GitHub Advisory, annotations.js source). The fix in commit 4155c48 adds hex validation for the color value and applies pdfEscape to prevent injection, with a fallback to 000000 for non-hex input (patch commit). Exploitation requires that an attacker can supply unsanitized input to the createAnnotation API — a realistic scenario in any application that accepts user-controlled data and passes it to jsPDF for PDF generation. No special privileges are required from the attacker's perspective, but a victim must open the resulting PDF.

Successful exploitation allows an attacker to embed arbitrary PDF objects — including JavaScript /Launch actions — into a generated PDF file, which can execute arbitrary code on the victim's system when the PDF is opened in a compatible viewer (e.g., launching calc.exe or other executables). The CVSS assessment rates both confidentiality and integrity impact as High, reflecting the potential for data exfiltration and system compromise (GitHub Advisory). Availability is not directly impacted, but the attack can serve as an initial access vector enabling further lateral movement or persistent compromise depending on the attacker's payload and the victim's environment (Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is approximately 0.046% (15th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack vector is network-accessible but requires user interaction (opening a crafted PDF), which somewhat limits opportunistic exploitation.

1. Identify a vulnerable application: Find a web application or service that uses jsPDF ≤ 4.2.0 and allows user-controlled input to be passed to the createAnnotation method's color parameter without sanitization.
2. Craft a malicious payload: Construct a string that breaks out of the PDF color string context and injects a PDF action object. Example payload for the color parameter:

   000000) /AA <<\/E <<\/S /Launch /F (calc.exe)>>>> (

3. Trigger PDF generation: Submit the crafted payload through the application's interface so that it is passed to doc.createAnnotation({ type: 'freetext', ..., color: payload }).
4. Distribute the malicious PDF: The application generates and saves (or serves) a PDF file containing the injected JavaScript or Launch action embedded in the annotation stream.
5. Achieve code execution: Deliver the PDF to a victim. When the victim opens the PDF in a viewer that supports JavaScript or Launch actions (e.g., Adobe Acrobat with JavaScript enabled), the injected action triggers, executing the attacker's payload on the victim's system (GitHub Advisory, jsPDF Security Advisory).

• File System: Generated PDF files containing unexpected /AA, /Launch, /JavaScript, or /JS dictionary entries within annotation objects; PDF files with annotation /DS strings containing unescaped parentheses, angle brackets, or PDF operator sequences.
• Logs: Application logs showing user-supplied input to PDF generation endpoints containing PDF syntax characters such as ), /AA, /Launch, /S, or <<; errors or anomalies in PDF generation pipelines.
• Network: Delivery of PDF files from web applications to end users where the PDF contains embedded action dictionaries not consistent with normal application output; outbound connections from PDF viewer processes to unexpected hosts after opening a PDF.
• Process: Unexpected child processes spawned by PDF viewer applications (e.g., calc.exe, cmd.exe, powershell.exe, or shell processes on Linux/macOS) following PDF open events (GitHub Advisory).

The vulnerability is fixed in jsPDF version 4.2.1; all users should upgrade immediately via npm (npm install jspdf@4.2.1 or later) (GitHub Advisory, patch commit). For organizations unable to patch immediately, the recommended workaround is to sanitize and validate all user-supplied input before passing it to the createAnnotation method — specifically, ensure the color parameter contains only valid hex color values. Additional defensive measures include restricting PDF generation to trusted input sources, disabling JavaScript execution in PDF viewers where possible, and educating users not to enable JavaScript in PDFs from untrusted sources. IBM has released updates for affected IBM API Connect and Cloudera Data Platform products (IBM Advisory).

The vulnerability was reported by researcher sofianeelhor and reviewed for remediation by peaktwilight, with the advisory published through GitHub's coordinated disclosure process (jsPDF Security Advisory). Red Hat tracked the issue via Bugzilla (Bug 2448547) and assessed it as high severity (Red Hat Bugzilla). Community coverage appeared on security aggregators and blogs including infinitsec.net and yazoul.net shortly after disclosure, and the issue was noted on Mastodon by security news accounts (Feedly).