GHSA-wfv2-pwc8-crg5
Critical · 9.6CVSS
9.6
EPSS
—
Published
Mar 17, 2026
CISA due date
—
The record
jsPDF has HTML Injection in New Window paths
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jspdf | 0 | 4.2.1 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.5-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r2 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.5-r2 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.5-r2 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r9 |
Related vulnerabilities
- CVE-2026-31938 jsPDF is a library to generate PDFs in JavaScript. Same vulnerability
- CVE-2026-31898 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- GHSA-7x6v-j9x4-qf24 jsPDF has a PDF Object Injection via FreeText color Also affects jspdf
- GHSA-p5xg-68wr-hm3m jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution… Also affects jspdf
- GHSA-9vjf-qc39-jprp jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method Also affects jspdf
- CVE-2026-25940 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- GHSA-67pg-wm7f-q7fj jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions Also affects jspdf
- CVE-2026-25755 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf