CVE-2026-22787
CVE-2026-22787 · html2pdf.js has a cross-site scripting vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in [email protected].
CVSS 8.7 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
html2pdf.js
- Versions du logiciel
- < 0.14.0: Concernée
Aucun correctif publié
html2pdf.js npm
- Plages de versions concernées
- SEMVER: < 0.14.0
Mettez à jour vers 0.14.0
Sources originales
- https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc
- https://github.com/eKoopmans/html2pdf.js/issues/865
- https://github.com/eKoopmans/html2pdf.js/pull/877
- https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b
- https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0
- https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability/
- https://nvd.nist.gov/vuln/detail/CVE-2026-22787