{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31898","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-03-09T21:59:02.689Z","datePublished":"2026-03-18T03:03:43.469Z","dateUpdated":"2026-08-24T12:06:54.765Z"},"containers":{"cna":{"title":"jsPDF has a PDF Object Injection via FreeText color","problemTypes":[{"descriptions":[{"cweId":"CWE-116","lang":"en","description":"CWE-116: Improper Encoding or Escaping of Output","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24","tags":["x_refsource_CONFIRM"],"url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24"},{"name":"https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8","tags":["x_refsource_MISC"],"url":"https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8"},{"name":"https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208","tags":["x_refsource_MISC"],"url":"https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208"},{"name":"https://github.com/parallax/jsPDF/releases/tag/v4.2.1","tags":["x_refsource_MISC"],"url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.1"}],"affected":[{"vendor":"parallax","product":"jsPDF","versions":[{"version":"< 4.2.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-03-18T03:03:43.469Z"},"descriptions":[{"lang":"en","value":"jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members."}],"source":{"advisory":"GHSA-7x6v-j9x4-qf24","discovery":"UNKNOWN"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-18T14:00:36.960715Z","id":"CVE-2026-31898","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-18T14:00:43.434Z"}},{"affected":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.8::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security 4.8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1775594119","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.9::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security 4.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1775594284","versionType":"rpm"}]}],"datePublic":"2026-03-18T03:03:43.469Z","descriptions":[{"lang":"en","value":"A flaw was found in jsPDF, a JavaScript library used for generating PDF documents. This vulnerability allows a remote attacker to inject arbitrary PDF objects, including JavaScript actions, into a generated PDF. This can occur if unsanitized user input is provided to the `createAnnotation` method's `color` parameter. When a user opens or interacts with the specially crafted PDF, these injected actions may execute, potentially leading to arbitrary code execution or sensitive information disclosure."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-31898"},{"name":"RHBZ#2448547","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448547"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31898.json"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7110"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7128"}],"solutions":[{"lang":"en","value":"RHSA-2026:7110: Red Hat Advanced Cluster Security 4.8"},{"lang":"en","value":"RHSA-2026:7128: Red Hat Advanced Cluster Security 4.9"}],"timeline":[{"lang":"en","time":"2026-03-18T04:02:12.103Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-18T03:03:43.469Z","value":"Made public."}],"title":"jspdf: jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"},"providerMetadata":{"orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP","dateUpdated":"2026-08-24T12:06:54.765Z"}}]}}