Update dependency jspdf to v4 [SECURITY] - autoclosed by renovate[bot] · Pull Request #871 · DaftDoris/newsdesk

renovate · 2026-03-17T17:25:00Z

This PR contains the following updates:

Package	Change	Age	Confidence
jspdf	`2.5.1` → `4.2.1`

GitHub Vulnerability Alerts

CVE-2026-31938

Impact

User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

"pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
"pdfjsnewwindow": the pdfJsUrl and filename options
"dataurlnewwindow": the filename option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});

Patches

The vulnerability has been fixed in jspdf@4.2.1.

Workarounds

Sanitize user input before passing it to the output method.

CVE-2026-31898

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

createAnnotation: color parameter

Example attack vector:

import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Release Notes

parallax/jsPDF (jspdf)

`v4.2.1`

Compare Source

This release fixes two security issues.

What's Changed

Fix HTML Injection in output methods vulnerability.
Fix PDF Object Injection via free text annotation color vulnerability.

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

`v4.2.0`

Compare Source

This release fixes three security issues.

What's Changed

Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton children) vulnerability.
Fix Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions vulnerability.
Fix PDF Object Injection via Unsanitized Input in addJS Method vulnerability.
Add "default" property to export section in package.json by @stefan-schweiger in #3953

New Contributors

@stefan-schweiger made their first contribution in #3953

Full Changelog: parallax/jsPDF@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

This release fixes several security issues.

What's Changed

Upgrade optional dompurify dependency to 3.3.1 in #3948
Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution vulnerability
Fix Stored XMP Metadata Injection (Spoofing & Integrity Violation) vulnerability
Fix Shared State Race Condition in addJS Method vulnerability
Fix Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder vulnerability

Full Changelog: parallax/jsPDF@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

This release fixes a critical path traversal/local file inclusion security vulnerability in the jsPDF Node.js build. File system access is now restricted by default and can be enabled by either using node's --permission flag or the new jsPDF.allowFsRead property.

There are no other breaking changes.

`v3.0.4`

Compare Source

This release includes a bunch of bugfixes. Thanks to all contributors!

What's Changed

[Snyk] Upgrade @babel/runtime from 7.28.3 to 7.28.4 by @MrRio in #3895
fix: cell function now properly accepts align parameter by @vishal-rathod-07 in #3896
Remove duplicated function "ga" from WebPDecoder.js by @jvdp in #3902
Fix font state management issue #3890 by @srikanth-s2003 in #3891
Fix pages property to always return current array reference ( #3898 ) by @Opineppes in #3899
Fix jsPDF + Vite compatibility issue #3851 by @tishajain25 in #3903
Do not add pages dynamically unless autoPaging is enabled by @anmiles in #3915
Fix: Context2d font regex too restrictive ( #3904 ) by @Opineppes in #3906
Fix Incorrect Typing for Margins in the TableConfig Interface Definition by @Maito1794 in #3816

New Contributors

@survivant made their first contribution in #3897
@vishal-rathod-07 made their first contribution in #3896
@jvdp made their first contribution in #3902
@srikanth-s2003 made their first contribution in #3891
@Opineppes made their first contribution in #3899
@tishajain25 made their first contribution in #3903
@anmiles made their first contribution in #3915
@josephyi made their first contribution in #3907
@Maito1794 made their first contribution in #3816

Full Changelog: parallax/jsPDF@v3.0.3...v3.1.0

`v3.0.3`

Compare Source

This release fixes regressions with PNG encoding that were introduced in v3.0.2.

What's Changed

Fix division by zero when calculating word spacing by @alxndr-pggm in #3879
fix scaling of form object bounding boxes by @HackbrettXXX in #3888
fix regressions in PNG encoding that were introduced in 3.0.2 by @HackbrettXXX in #3887

New Contributors

@alxndr-pggm made their first contribution in #3879

Full Changelog: parallax/jsPDF@v3.0.2...v3.0.3

`v3.0.2`

Compare Source

This release fixes a security issue where parsing of corrupt PNG images could lead to long running loops and denial of service.

What's Changed

[Snyk] Upgrade @babel/runtime from 7.26.7 to 7.26.9 by @MrRio in #3847
Fix parsing corrupt PNG images in addImage method by @HackbrettXXX in #3880. The atob and btoa dependencies have been removed and the fast-png dependency has been added.

New Contributors

@WardenDrew made their first contribution in #3872

Full Changelog: parallax/jsPDF@v3.0.1...v3.0.2

`v3.0.1`

Compare Source

This release fixes two security vulnerabilities:

Upgrade optional dependency canvg to 3.0.11
Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

`v3.0.0`

Compare Source

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

@nlqivision made their first contribution in #3812
@dependabot made their first contribution in #3826
@hainenber made their first contribution in #3827

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

`v2.5.2`

Compare Source

This release upgrades the Dompurify dependency to 2.5.4 with fixes a vulnerability with high severity: GHSA-mmhx-hmjr-r674.

It also upgrades fflate, core-js, and @babel/runtime to more recent versions.

What's Changed

Implement justifying for unicode fonts by @owenl131 in #3285
chore: update dompurify version 2.5.4 by @MarcioMeier in #3768
[Snyk] Upgrade fflate from 0.4.8 to 0.8.1 by @MrRio in #3666
[Snyk] Upgrade core-js from 3.6.5 to 3.33.0 by @MrRio in #3664
[Snyk] Upgrade @babel/runtime from 7.14.6 to 7.23.2 by @MrRio in #3665

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Automerge: Enabled

cloudflare-workers-and-pages · 2026-03-17T17:25:07Z

Deploying newsdesk with Cloudflare Pages

Latest commit:	`a465af2`
Status:	✅ Deploy successful!
Preview URL:	https://77feb7b0.newsdesk.pages.dev
Branch Preview URL:	https://renovate-npm-jspdf-vulnerabi.newsdesk.pages.dev

View logs

sonarqubecloud · 2026-03-17T17:25:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Update dependency jspdf to v4 [SECURITY]

a465af2

renovate Bot enabled auto-merge (squash) March 17, 2026 17:25

renovate-approve-2 Bot approved these changes Mar 17, 2026

View reviewed changes

renovate-approve Bot approved these changes Mar 17, 2026

View reviewed changes

renovate Bot assigned chrisns Mar 17, 2026

renovate Bot changed the title ~~Update dependency jspdf to v4 [SECURITY]~~ Update dependency jspdf to v4 [SECURITY] - autoclosed Mar 17, 2026

renovate Bot closed this Mar 17, 2026

auto-merge was automatically disabled March 17, 2026 20:52
Pull request was closed

renovate Bot deleted the renovate/npm-jspdf-vulnerability branch March 17, 2026 20:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency jspdf to v4 [SECURITY] - autoclosed#871

Update dependency jspdf to v4 [SECURITY] - autoclosed#871
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-jspdf-vulnerability

renovate Bot commented Mar 17, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Mar 17, 2026

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Impact

Patches

Workarounds

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

New Contributors

What's Changed

Configuration

Uh oh!

cloudflare-workers-and-pages Bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying newsdesk with Cloudflare Pages

Uh oh!

sonarqubecloud Bot commented Mar 17, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cloudflare-workers-and-pages Bot commented Mar 17, 2026 •

edited

Loading