8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24737

CVE-2026-24737: jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24737

CVE-2026-24737:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jspdf	npm	<= 4.0.0	4.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-24737, is a PDF injection issue within the AcroForm module of the jsPDF library. The root cause is the improper escaping of user-controlled input when generating PDF form elements, which allows for the injection of arbitrary PDF objects and subsequent JavaScript execution.

The analysis of the patch da291a5f01b96282545c9391996702cdb8879f79 reveals two primary attack vectors:

Choice Fields (AcroFormChoiceField): The methods addOption and setOptions serve as entry points for malicious data. User-provided option strings were passed to an internal function, arrayToPdfArray, for inclusion in the PDF structure. This function failed to escape strings that began with a forward slash ('/'), treating them as literal PDF objects instead of string literals. This allowed an attacker to inject malicious PDF syntax, such as /AA (Additional Actions) to trigger JavaScript execution. The patch introduces a new pdfEscapeName function and modifies arrayToPdfArray to use it, ensuring that such strings are properly escaped.
Button Fields (AcroFormCheckBox, AcroFormRadioButton): These classes inherit from AcroFormButton. The appearanceState property setter on AcroFormButton was vulnerable. It would prepend a '/' to the user-provided value without any sanitization. This created another injection vector where a crafted string could be interpreted as PDF commands. The patch addresses this by applying the pdfEscapeName function to the value within the setter, neutralizing the threat.

Therefore, any runtime profile during exploitation would show calls to AcroFormChoiceField.addOption or AcroFormChoiceField.setOptions, or property setting on AcroFormCheckBox.appearanceState or AcroFormRadioButton.appearanceState, which internally calls the vulnerable setter on AcroFormButton.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.