CVE-2026-31938

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31938", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.655Z", "datePublished": "2026-03-18T03:05:44.964Z", "dateUpdated": "2026-09-07T12:04:46.902Z"}, "containers": {"cna": {"title": "jsPDF has HTML Injection in New Window paths", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5"}, {"name": "https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7", "tags": ["x_refsource_MISC"], "url": "https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7"}, {"name": "https://github.com/parallax/jsPDF/releases/tag/v4.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.2.1"}], "affected": [{"vendor": "parallax", "product": "jsPDF", "versions": [{"version": "< 4.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T03:05:44.964Z"}, "descriptions": [{"lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method."}], "source": {"advisory": "GHSA-wfv2-pwc8-crg5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T13:59:39.345496Z", "id": "CVE-2026-31938", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:59:51.966Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.8::el8"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775594119", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.9::el8"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775594284", "versionType": "rpm"}]}], "datePublic": "2026-03-18T03:05:44.964Z", "descriptions": [{"lang": "en", "value": "A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can exploit this vulnerability by providing malicious input to the `options` argument of the `output` function. When a victim creates and opens a PDF using this unsanitized input, arbitrary HTML, including scripts, can be injected and executed within the victim's browser context. This Cross-Site Scripting (XSS) vulnerability allows the attacker to extract or modify sensitive information from the victim's browser."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-31938"}, {"name": "RHBZ#2448550", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448550"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31938.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7110"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7128"}], "solutions": [{"lang": "en", "value": "RHSA-2026:7110: Red Hat Advanced Cluster Security 4.8"}, {"lang": "en", "value": "RHSA-2026:7128: Red Hat Advanced Cluster Security 4.9"}], "timeline": [{"lang": "en", "time": "2026-03-18T04:02:27.320Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-18T03:05:44.964Z", "value": "Made public."}], "title": "jspdf: jsPDF: Cross site scripting via unsanitized output options", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:46.902Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "jspdf: jsPDF: Cross site scripting via unsanitized output options", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:advanced_cluster_security:4.8::el8"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4.8", "versions": [{"status": "unaffected", "version": "1775594119", "lessThan": "*", "versionType": "rpm"}], "packageName": "advanced-cluster-security/rhacs-main-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:advanced_cluster_security:4.9::el8"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4.9", "versions": [{"status": "unaffected", "version": "1775594284", "lessThan": "*", "versionType": "rpm"}], "packageName": "advanced-cluster-security/rhacs-main-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-03-18T04:02:27.320Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-18T03:05:44.964Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:7110: Red Hat Advanced Cluster Security 4.8"}, {"lang": "en", "value": "RHSA-2026:7128: Red Hat Advanced Cluster Security 4.9"}], "x_adpType": "supplier", "datePublic": "2026-03-18T03:05:44.964Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-31938", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448550", "name": "RHBZ#2448550", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31938.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7110", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7128", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can exploit this vulnerability by providing malicious input to the `options` argument of the `output` function. When a victim creates and opens a PDF using this unsanitized input, arbitrary HTML, including scripts, can be injected and executed within the victim's browser context. This Cross-Site Scripting (XSS) vulnerability allows the attacker to extract or modify sensitive information from the victim's browser."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:46.902Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31938", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-18T13:59:39.345496Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:59:43.410Z"}}], "cna": {"title": "jsPDF has HTML Injection in New Window paths", "source": {"advisory": "GHSA-wfv2-pwc8-crg5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "parallax", "product": "jsPDF", "versions": [{"status": "affected", "version": "< 4.2.1"}]}], "references": [{"url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5", "name": "https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7", "name": "https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/parallax/jsPDF/releases/tag/v4.2.1", "name": "https://github.com/parallax/jsPDF/releases/tag/v4.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T03:05:44.964Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31938", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:04:46.902Z", "dateReserved": "2026-03-10T15:10:10.655Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T03:05:44.964Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jsPDF", "vendor": "parallax", "versions": [{"status": "affected", "version": "< 4.2.1"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.8::el8"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775594119", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.9::el8"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1775594284", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E32C16E0-23FB-49ED-B364-2170D7FC9935", "versionEndExcluding": "4.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method."}, {"lang": "es", "value": "jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versi\u00f3n 4.2.1, el control del usuario sobre el argumento 'options' de la funci\u00f3n 'output' permite a los atacantes inyectar HTML arbitrario (como scripts) en el contexto del navegador en el que se abre el PDF creado. La vulnerabilidad puede ser explotada en el siguiente escenario: el atacante proporciona valores para las opciones de salida, por ejemplo, a trav\u00e9s de una interfaz web. Estos valores se pasan luego sin sanear (autom\u00e1tica o semi-autom\u00e1ticamente) a la v\u00edctima del ataque. La v\u00edctima crea y abre un PDF con el vector de ataque utilizando una de las sobrecargas de m\u00e9todo vulnerables dentro de su navegador. El atacante puede as\u00ed inyectar scripts que se ejecutan en el contexto del navegador de la v\u00edctima y puede extraer o modificar secretos de este contexto. La vulnerabilidad ha sido corregida en jspdf@4.2.1. Como soluci\u00f3n alternativa, sanear la entrada del usuario antes de pasarla al m\u00e9todo de salida."}], "id": "CVE-2026-31938", "lastModified": "2026-08-18T12:18:06.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31938", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T13:59:39.345496Z", "version": "2.0.3"}}]}, "published": "2026-03-18T04:17:23.507", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.2.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7110"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7128"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-31938"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448550"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31938.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "jspdf: jsPDF: Cross site scripting via unsanitized output options", "id": "2448550", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448550"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can exploit this vulnerability by providing malicious input to the `options` argument of the `output` function. When a victim creates and opens a PDF using this unsanitized input, arbitrary HTML, including scripts, can be injected and executed within the victim's browser context. This Cross-Site Scripting (XSS) vulnerability allows the attacker to extract or modify sensitive information from the victim's browser."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-31938", "package_state": [{"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "advanced-cluster-security/rhacs-main-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}], "public_date": "2026-03-18T03:05:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31938\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31938\nhttps://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7\nhttps://github.com/parallax/jsPDF/releases/tag/v4.2.1\nhttps://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "jsPDF", "source": "cna", "vendor": "parallax"}, "product": "jspdf", "vendor": "parall"}], "analysis": {"en": {"generated_at": "2026-03-18T19:37:14.967173+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading jsPDF to version 4.2.1 or later.", "Sanitize or validate all user-supplied values for the output options before calling the output method as a temporary workaround.", "Verify that no other areas of the application invoke the vulnerable function with unsanitized input."], "summary": {"action": "Immediate Patch", "impact": "Client-side XSS / Script Execution"}, "threat_synthesis": {"affected_systems": "All installations of the parallax:jsPDF library older than version 4.2.1 are affected. The vulnerability exists in any instance where the vendor\u2019s output function receives unsanitized user input before creating the PDF.", "description_and_impact": "jsPDF is a JavaScript library used to generate PDFs. Prior to version 4.2.1, a user-controlled options argument to the output function allows arbitrary HTML, including executable scripts, to be injected into a PDF that opens in a browser. The injected scripts run in the victim\u2019s browser context, enabling extraction or modification of secrets and other malicious actions (CWE\u201179).", "risk_and_exploitability": "The CVSS score is 9.6 indicating critical impact. EPSS is below 1\u202f%, and the flaw is not listed in the KEV catalog, suggesting low current exploitation prevalence. An attacker can supply malicious options via a web interface or other input channel; the victim then opens the resulting PDF in their browser, automatically triggering the injected scripts. Exploitation requires the victim to view the PDF, and no remote code execution on the server side is provided by the flaw. Potential damage includes script execution, data theft, or privilege escalation within the victim\u2019s browser session."}}}}, "created": "2026-03-18T10:41:56.849435+00:00", "updated": "2026-03-24T10:59:26.212096+00:00", "vendors": ["parall", "parall$PRODUCT$jspdf"]}