-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability lies in the extractImageFromDataUrl function, which used a ReDoS-prone regex to parse data URLs. This function is called by addImage (and likely html/addSvgAsImage). The commit explicitly fixes extractImageFromDataUrl by replacing the regex with safer parsing. While addImage, html, and addSvgAsImage are the user-facing entry points, the root cause is the insecure parsing in extractImageFromDataUrl. Confidence is high for extractImageFromDataUrl and addImage due to direct evidence in the diff/advisories, and medium for html/addSvgAsImage as they are referenced in advisories but lack explicit code examples.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jspdf | npm | < 3.0.1 | 3.0.1 |
JavaScriptJavaScriptKEV Misses 88% of Exploited CVEs- Get the report