The vulnerability allows attackers who provide arbitrary input to the addMetadata function of jsPDF to inject any XMP metadata into the generated PDF. If the PDF is subsequently signed, stored, or processed, this injected metadata can alter document contents or embed malicious information, undermining the confidentiality, integrity, or authenticity guarantees of signed PDFs. The weakness is an injection of unfiltered XML (CWE‑74) combined with an improper handling of manifest information (CWE‑91).

The flaw exists in the Parallax jsPDF library versions preceding 4.1.0. It applies to any deployment that exposes the addMetadata method to user data, including browser-based and Node.js environments that build PDFs with this library.

The CVSS score of 6.9 indicates a high severity for integrity impact. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and it is not listed in CISA’s KEV catalog. Attackers can potentially exploit the flaw by supplying crafted XMP data via the addMetadata function, which may be invoked in web applications or other software that generates PDFs dynamically. The attack vector is inferred to be through user-controlled input into the library’s metadata function rather than direct code execution.