CVE-2026-24040
Medium · 4.8CVSS
4.8
EPSS
0.3%
Published
Feb 2, 2026
CISA due date
—
The record
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jspdf | 0 | 4.1.0 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.4.0-r2 |
Related vulnerabilities
- GHSA-cjw8-79x6-5cj4 jsPDF has Shared State Race Condition in addJS Plugin Same vulnerability
- CVE-2026-31938 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- CVE-2026-31898 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- GHSA-wfv2-pwc8-crg5 jsPDF has HTML Injection in New Window paths Also affects jspdf
- GHSA-7x6v-j9x4-qf24 jsPDF has a PDF Object Injection via FreeText color Also affects jspdf
- GHSA-p5xg-68wr-hm3m jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution… Also affects jspdf
- GHSA-9vjf-qc39-jprp jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method Also affects jspdf
- CVE-2026-25940 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf