Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2026-25755 is a high-severity Code Injection (CWE-94) vulnerability in Parall Jspdf. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25755 is a code injection vulnerability in the jsPDF JavaScript library, which is used to generate PDFs in web applications, affecting versions prior to 4.2.0. The issue stems from insufficient validation of user-controlled arguments passed to the `addJS` method, enabling attackers to escape the JavaScript string delimiter and inject arbitrary PDF objects into the resulting document. This flaw is classified under CWE-94 (Improper Control of Generation of Code) and CWE-116 (Improper Encoding or Escaping of Output), with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
An attacker who can influence the input to the `addJS` method—such as through untrusted user-supplied JavaScript code in a web form or API—can craft a payload to break out of the string context and embed malicious PDF streams or objects. Upon opening the generated PDF in a viewer, victims face risks including execution of arbitrary actions (e.g., JavaScript within the PDF) or structural alterations to the document, potentially leading to high confidentiality and integrity impacts like data exfiltration or tampering. Exploitation requires no privileges and is network-accessible with low complexity, but depends on user interaction to open the malicious PDF.
The vulnerability was addressed in jsPDF version 4.2.0, as detailed in the project's security advisory (GHSA-9vjf-qc39-jprp), release notes, and the fixing commit. Developers are advised to upgrade immediately; as a temporary measure, escape parentheses in any user-provided JavaScript code before invoking the `addJS` method to prevent delimiter evasion.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8109
Vulnerability Data
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the…
more
JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.2.1V1.2.3V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.
Security testing can detect missing or incorrect encoding but does not itself implement the control.
Secure development life cycle mandates output encoding/escaping practices that directly prevent improper encoding.
Application security requirements include explicit rules for safe output handling and encoding.
Secure architecture principles reduce the likelihood of missing encoding but do not prescribe the actual technique.
Controls that restrict unauthorized or malicious code from being introduced via external networks or removable media limit opportunities for an attacker to inject and execute arbitrary code.