Skip to content
OpenAdvisories

Package · npm

jspdf

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-24040

    jsPDF has a Shared State Race Condition in addJS Plugin

    jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), thi…

    parallax jsPDF jspdf npm
  • Medium 6.9
    CVE-2026-24043

    jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

    jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can in…

    parallax jsPDF jspdf npm
  • Medium 5.9
    CVE-2021-23353

    Regular Expression Denial of Service (ReDoS)

    This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

    jspdf npm
  • Medium 6.1
    CVE-2020-7690

    Cross-site scripting in jspdf

    All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

    jspdf npm
  • Medium 6.3
    CVE-2020-7691

    Cross-site Scripting (XSS)

    In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

    jspdf npm