Security

Report a vulnerability

SECURITY.md

Security Policy

Please also refer to https://github.com/parallax/jsPDF/blob/master/README.md#security

Supported Versions

Only the latest major/minor versions are supported with security updates.

Reporting a Vulnerability

Please use the "Report a vulnerability" button here.

HTML Injection in output methods
GHSA-wfv2-pwc8-crg5 published Mar 17, 2026 by HackbrettXXX

Critical
PDF Object Injection via free text annotation color
GHSA-7x6v-j9x4-qf24 published Mar 17, 2026 by HackbrettXXX

High
PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton children)
GHSA-p5xg-68wr-hm3m published Feb 19, 2026 by HackbrettXXX

High
Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
GHSA-67pg-wm7f-q7fj published Feb 19, 2026 by HackbrettXXX

High
PDF Object Injection via Unsanitized Input in addJS Method
GHSA-9vjf-qc39-jprp published Feb 19, 2026 by HackbrettXXX

Critical
PDF Injection in AcroForm module allows Arbitrary JavaScript Execution
GHSA-pqxr-3g65-p328 published Feb 2, 2026 by HackbrettXXX

High
Stored XMP Metadata Injection (Spoofing & Integrity Violation)
GHSA-vm32-vv63-w422 published Feb 2, 2026 by HackbrettXXX

Moderate
Shared State Race Condition in addJS Method
GHSA-cjw8-79x6-5cj4 published Feb 2, 2026 by HackbrettXXX

Moderate
Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
GHSA-95fx-jjr5-f39c published Feb 2, 2026 by HackbrettXXX

High
Local File Inclusion/Path Traversal
GHSA-f8cm-6447-x5h2 published Jan 3, 2026 by HackbrettXXX

Critical

Learn more about advisories related to parallax/jsPDF in the GitHub Advisory Database