The vulnerability resides in the Acroform module of jsPDF, a JavaScript library used for PDF generation. Unsanitized input to methods such as AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, or AcroFormRadioButton.appearanceState can inject arbitrary PDF objects, notably JavaScript actions. When a victim opens the resulting PDF, the embedded JavaScript is executed within the PDF viewer, enabling unauthorized code execution. This flaw is linked to input handling weaknesses (CWE‑116) and complex object injection (CWE‑917).

Any application that incorporates jsPDF prior to version 4.1.0 is susceptible. The affected codebases typically include web or Node.js projects that use the Acroform API for form fields. The weakness applies to all supported jsPDF releases below 4.1.0; the fix is delivered in jsPDF 4.1.0 and later. Projects that rely on older jsPDF or that expose these methods to user input should be considered at risk.

The CVSS base score of 8.1 categorizes the flaw as high severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not documented in the CISA KEV catalog. An attacker would need the ability to supply unsanitized data to the vulnerable Acroform functions, which could be achieved by a compromised or malicious application generating PDFs, or, in the worst case, by embedding malicious data into a legitimate PDF. When the victim opens the PDF in a viewer that executes embedded scripts, arbitrary JavaScript runs with the viewer's privileges, offering potential for data exfiltration, credential theft, or further exploitation.