jsPDF, a JavaScript PDF generation library, contains a race condition in its addJS method. The method uses a shared variable to store JavaScript content, so when multiple Node.js requests generate PDFs at the same time, one user's JavaScript payload can overwrite another's. The result is that a PDF delivered to User A may contain the JavaScript and sensitive data that were intended for User B, leading to cross‑user data leakage.

This flaw affects the Parallax jsPDF package in all releases prior to version 4.1.0. The vulnerability is relevant when the library is used in a Node.js environment, such as a web server that serves PDFs on demand. Client‑side use may also experience the race condition, though server‑side exposure is the main concern.

The flaw carries a CVSS score of 6.3 and an EPSS score of less than 1 %, indicating a moderate severity and low current exploitation probability. It is not listed in the CISA KEV catalog. An attacker who can induce concurrent PDF generation requests to a vulnerable server can cause the shared state to be overwritten, resulting in unintended exposure of JavaScript payloads and any data that the original user provided. The attack vector is inferred to be a concurrent request pattern rather than a remote code execution path. Because the data leakage only occurs when addJS is used, a deliberate or accidental use of the plugin can trigger the vulnerability.