CVE-2026-24737
highpriority · track · 0EPSS 0.006 · 48 %ileCHDEEURUUSEPSS · scored 2026-10-27
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.23
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
- LabX Standardall versionsmettler_toledo_psirtCHcpe:2.3:a:mettler_toledo:labx_standard:21.3.22:*:*:*:*:*:*:*
- LabX Standardall versionsfixedmettler_toledo_psirtCHcpe:2.3:a:mettler_toledo:labx_standard:21.4.23:*:*:*:*:*:*:*
advisories (4)
Vendor and ecosystem advisories describing this.
- VDE-2026-064METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.32026-06-09csaf · mettler_toledo_psirtCH
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.
- WID-SEC-W-2026-0553HCL BigFix: Mehrere SchwachstellenDeutsch2026-03-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Informationen offenzulegen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um Dateien zu manipulieren.
- WID-SEC-W-2026-2933Splunk SOAR: Mehrere SchwachstellenDeutsch2026-08-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
- GHSA-pqxr-3g65-p328jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution2026-02-02ghsa · osvUS
### Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are: * `AcroformChoiceField.addOption` * `AcroformChoiceField.setOptions` * `AcroFormCheckBox.appearanceState` * `AcroFormRadioButton.appearanceState` Example attack vector: ```js import { jsPDF } from "jspdf" const doc = new jsPDF(); var choiceField = new doc.AcroFormChoiceField(); choiceField.T = "VulnerableField"; choiceField.x = 20; choiceField.y = 20; choiceField.width = 100; choiceField.height = 20; // PAYLOAD: // 1. Starts with "/" to bypass escaping. // 2. "dummy]" closes the array. // 3. "/AA" injects an Additional Action (Focus event). // 4. "/JS" executes arbitrary JavaScript. const payload = "/dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage ["; choiceField.addOption(payload); doc.addField(choiceField); doc.save("test.pdf"); ``` ### Patches The vulnerability has been fixed in jsPDF@4.1.0. ### Workarounds Sanitize user input before passing it to the vulnerable API members. ### Credits Research and fix: Ahmet Artuç
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79cnnvd
- https://github.com/parallax/jsPDF/releases/tag/v4.1.0cnnvd
- https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328cnnvd
- https://parall.ax/products/jspdfPatchcnnvd
- https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79enisa_euvd
- https://github.com/parallax/jsPDF/releases/tag/v4.1.0enisa_euvd
- https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328enisa_euvd
- https://access.redhat.com/errata/RHSA-2026:4466nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan