jsPDF is a JavaScript library used to generate PDFs. Prior to version 4.2.1, a user-controlled options argument to the output function allows arbitrary HTML, including executable scripts, to be injected into a PDF that opens in a browser. The injected scripts run in the victim’s browser context, enabling extraction or modification of secrets and other malicious actions (CWE‑79).

All installations of the parallax:jsPDF library older than version 4.2.1 are affected. The vulnerability exists in any instance where the vendor’s output function receives unsanitized user input before creating the PDF.

The CVSS score is 9.6 indicating critical impact. EPSS is below 1 %, and the flaw is not listed in the KEV catalog, suggesting low current exploitation prevalence. An attacker can supply malicious options via a web interface or other input channel; the victim then opens the resulting PDF in their browser, automatically triggering the injected scripts. Exploitation requires the victim to view the PDF, and no remote code execution on the server side is provided by the flaw. Potential damage includes script execution, data theft, or privilege escalation within the victim’s browser session.