jsPDF is a JavaScript library used to generate PDF documents. A flaw in versions prior to 4.2.1 allows an attacker to supply an unsanitized value for the color argument in the createAnnotation method, which is then inserted directly into the PDF stream. By crafting special content, the attacker can inject arbitrary PDF objects, including JavaScript actions that execute when a viewer opens or interacts with the PDF, potentially enabling remote code execution within the viewer environment.

The vulnerability affects the open‑source library jsPDF maintained by parallax. Any installation that uses a jsPDF version older than 4.2.1 is susceptible; the fix is available in the 4.2.1 release and later.

The CVSS base score is 8.1, indicating high severity. EPSS is below 1%, so the likelihood of widespread exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to create a malicious PDF or to supply crafted input to an application that uses jsPDF, which is then opened by a victim’s PDF reader. Once the PDF is accessed, the injected JavaScript actions may run with the privileges of the viewer, enabling code execution, data exfiltration, or other malicious behavior.