Jspdf

This hub aggregates every CVE we track for Jspdf, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Jspdf.

• CVE-2026-31938jsPDF has HTML Injection in New Window paths9.6Mar 18, 2026
• CVE-2026-31898jsPDF has a PDF Object Injection via FreeText color8.1Mar 18, 2026
• CVE-2026-25940jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)8.1Feb 19, 2026
• CVE-2026-25755jsPDF has PDF Object Injection via Unsanitized Input in addJS Method8.1Feb 19, 2026
• CVE-2026-25535jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions7.5Feb 19, 2026
• CVE-2026-24040jsPDF has a Shared State Race Condition in addJS Plugin4.8Feb 2, 2026
• CVE-2026-24043jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)5.4Feb 2, 2026
• CVE-2026-24133jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder6.5Feb 2, 2026
• CVE-2026-24737jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution8.1Feb 2, 2026
• CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerability7.5Jan 5, 2026
• CVE-2025-57810jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)7.5Aug 26, 2025
• CVE-2025-29907jsPDF Bypass Regular Expression Denial of Service (ReDoS)7.5Mar 18, 2025
• CVE-2021-23353Regular Expression Denial of Service (ReDoS)5.9Mar 9, 2021
• CVE-2020-7690All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.6.1Jul 6, 2020
• CVE-2020-7691Cross-site Scripting (XSS)6.3Jul 6, 2020