8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25940

CVE-2026-25940: jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25940

CVE-2026-25940:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jspdf	npm	< 4.2.0	4.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of user-supplied input for certain properties within the AcroForm module of jsPDF. Specifically, the setters for the AS property on AcroFormButton and the appearanceState and value properties on AcroFormChildClass were directly assigning user input to internal variables without any sanitization. This allowed an attacker to inject malicious PDF object syntax, including JavaScript actions, into the generated PDF file. When a victim interacts with the crafted form field in the PDF (e.g., hovering over a radio button), the injected JavaScript would execute. The provided patch fixes this by introducing sanitization through the pdfEscapeName function, which properly escapes the input before it's embedded into the PDF structure, thus preventing the injection of arbitrary PDF objects.

Vulnerable functions

AcroFormButton.set:AS

src/modules/acroform.js

The setter for the 'AS' property on 'AcroFormButton' was vulnerable to PDF injection. It directly assigned user-provided input to the internal '_AS' variable without sanitization. An attacker could provide a crafted string to inject malicious PDF objects, leading to arbitrary JavaScript execution. The patch applies 'pdfEscapeName' to sanitize the input.

AcroFormChildClass.set:appearanceState

src/modules/acroform.js

The setter for the 'appearanceState' property on 'AcroFormChildClass' was vulnerable to PDF injection. It directly assigned user-provided input to the internal '_AS' variable without proper escaping. This allowed an attacker to inject arbitrary PDF script objects, such as JavaScript, which would be executed by the PDF reader. The patch mitigates this by sanitizing the input using 'pdfEscapeName'.

AcroFormChildClass.set:value

src/modules/acroform.js

The setter for the 'value' property on 'AcroFormChildClass' was also vulnerable. It concatenated a '/' with the user-provided value and assigned it to the internal '_AS' variable. This lacked sanitization and could be exploited for PDF injection in a similar way to the 'appearanceState' property. The patch addresses this by using 'pdfEscapeName' to sanitize the input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.