A flaw in the AcroForm module of the jsPDF library enables an attacker to inject arbitrary PDF objects, including JavaScript actions, through uncontrolled user‑supplied input. When a user loads the impacted PDF and hovers over a radio button, the embedded JavaScript executes, potentially allowing full code execution within the PDF viewer. This vulnerability is identified as CWE‑116, an input/output communication error that permits unauthorized code execution.

The issue affects versions of jsPDF before 4.2.0, supplied by the vendor Parallax. Attacks arise when client code manipulates the RadioButton.createOption method or the AS property of AcroForm, properties that accept unsanitized input. The library runs in Node.js environments and is commonly used to programmatically generate PDFs.

The CVSS score of 8.1 signals a high severity condition, while the EPSS score of less than 1% suggests a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to open the malicious PDF in a renderer that honors embedded JavaScript and to hover over a radio button, so the attack vector is client‑side and needs user interaction to trigger the payload.