CVE-2026-24043

CVE-2026-24043 · jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published

2026-02-02T20:34:50.617Z

Updated

2026-02-03T15:27:51.282Z

Stack: node

Check your server →