GHSA-vm32-vv63-w422
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jspdf | 0 | 4.1.0 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.4.0-r3 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.4.0-r2 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r7 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.4.0-r2 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.4.0-r2 |
Related vulnerabilities
- CVE-2026-24043 jsPDF is a library to generate PDFs in JavaScript. Same vulnerability
- CVE-2026-31938 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- CVE-2026-31898 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- GHSA-wfv2-pwc8-crg5 jsPDF has HTML Injection in New Window paths Also affects jspdf
- GHSA-7x6v-j9x4-qf24 jsPDF has a PDF Object Injection via FreeText color Also affects jspdf
- GHSA-p5xg-68wr-hm3m jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution… Also affects jspdf
- GHSA-9vjf-qc39-jprp jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method Also affects jspdf
- CVE-2026-25940 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf