chore(deps): update dependency jspdf to v4.2.1 [security]

[oep-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jspdf	4.2.0 → 4.2.1

GitHub Vulnerability Alerts

CVE-2026-31898

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

• createAnnotation: color parameter

Example attack vector:

import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

CVE-2026-31938

Impact

User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

• "pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
• "pdfjsnewwindow": the pdfJsUrl and filename options
• "dataurlnewwindow": the filename option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});

Patches

The vulnerability has been fixed in jspdf@4.2.1.

Workarounds

Sanitize user input before passing it to the output method.

---

jsPDF has a PDF Object Injection via FreeText color

CVE-2026-31898 / GHSA-7x6v-j9x4-qf24

More information

Details

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

• createAnnotation: color parameter

Example attack vector:

import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24
• https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8
• https://github.com/parallax/jsPDF
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsPDF has HTML Injection in New Window paths

CVE-2026-31938 / GHSA-wfv2-pwc8-crg5

More information

Details

Impact

User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

• "pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
• "pdfjsnewwindow": the pdfJsUrl and filename options
• "dataurlnewwindow": the filename option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});

Patches

The vulnerability has been fixed in jspdf@4.2.1.

Workarounds

Sanitize user input before passing it to the output method.

Severity

• CVSS Score: 9.6 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5
• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7
• https://github.com/parallax/jsPDF
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

parallax/jsPDF (jspdf)

v4.2.1

Compare Source

This release fixes two security issues.

What's Changed

• Fix HTML Injection in output methods vulnerability.
• Fix PDF Object Injection via free text annotation color vulnerability.

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.