CVE WatchJul 15, 2026

CVE-2026-25755

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to

CVSS

8.1

High

EPSS

0.8%

p53

KEV

—

Exploit Today

0-100

Published: Feb 19, 2026 · Last modified: Jul 15, 2026 · CWE-94 · CWE-116

EPSS · 30d

0.8%EPSS · 30 days0.8%

2026-06-302026-07-16

Technical description

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability2d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2d CVE-2026-154107.2 HIG

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability22h CVE-2025-670389.8 CRI

55.3%

KEV—67Lantronix EDS5000 Code Injection Vulnerability11d CVE-2021-416539.8 CRI

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.8d CVE-2023-362558.8 HIG

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.8d