jsPDF is a JavaScript library that generates PDFs. In versions prior to 4.2.0 the addJS method accepts a user‑supplied argument without sanitization, allowing an attacker to inject arbitrary PDF objects by escaping the JavaScript string delimiter. The injected objects can contain malicious code or alter the document structure, so anyone who opens the resulting PDF may trigger code execution or compromise the integrity of the document.

The vulnerability affects the Parallax jsPDF library in all releases older than 4.2.0. Any application that incorporates jsPDF before that version and calls addJS with external input is potentially exposed. The issue is fixed in jsPDF 4.2.0 and later releases.

With a CVSS score of 8.1, the risk is considered high, but the EPSS score of less than 1 % indicates a very low probability of current exploitation. It is not listed in the CISA KEV catalog. The attack vector is likely through user‑generated data supplied to addJS; the attacker must craft a payload that escapes the JavaScript string. Successful exploitation would allow execution of arbitrary PDF objects, potentially leading to code execution or document tampering when a victim opens the file.