html2pdf.js is a client‑side library that converts web content into PDF documents. Versions prior to 0.14.0 embed supplied text directly into the DOM without proper sanitization. This flaw allows an attacker to inject malicious scripts that execute in the user’s browser, potentially exposing or altering sensitive data and disrupting page functionality.

The vulnerability affects the eKoopmans html2pdf.js library on any Node.js environment that uses the library before version 0.14.0. Users who incorporate the old code into web pages or web applications are at risk.

The flaw scores 8.7 on the CVSS scale, indicating high severity, and the EPSS probability is low (<1%). It is not listed in the CISA KEV catalog. Exploitation requires delivery of malicious text to the application, which is then processed by html2pdf.js when a user initiates a PDF conversion. Because the attack occurs entirely on the client side, it can occur without additional network interaction once the code is loaded into the browser.