8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22787

CVE-2026-22787: html2pdf.js has a cross-site scripting vulnerability

html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in html2pdf.js@0.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22787

CVE-2026-22787:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
html2pdf.js	npm	< 0.14.0	0.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the createElement function within src/utils.js. The function's purpose is to create an HTML element. Before the patch, when provided with an innerHTML option, it would directly assign this value to the element's innerHTML property. The code included a weak attempt to mitigate XSS by removing <script> tags, but this is an incomplete solution that fails to address other common XSS vectors, such as attributes like onerror. The provided exploit const maliciousHTML = '<img src=x onerror="alert(document.cookie)">'; would bypass this weak filter. The fix, introduced in commit 988826e336035b39a8608182d7b73c0e3cd78c7b, replaces the unsafe innerHTML assignment with a call to DOMPurify.sanitize(), which is a robust library for preventing XSS. Therefore, the createElement function is the specific location of the vulnerability, as it's the point where the unsanitized, user-controlled input is processed and attached to the DOM.

Vulnerable functions

createElement

src/utils.js

The function `createElement` in `src/utils.js` was vulnerable to XSS. It directly assigned user-provided string input to an element's `innerHTML` property. The existing sanitization was insufficient as it only attempted to remove `<script>` tags, leaving other XSS vectors like `onerror` attributes open. The patch fixed this by using the `DOMPurify` library to sanitize the input before assignment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.