CVE-2026-31898

High

Published: 18 March 2026

Published

18 March 2026

Modified

20 March 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Score 0.0004 12.1th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31898 is a high-severity Improper Encoding or Escaping of Output (CWE-116) vulnerability in Parall Jspdf. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires updating jsPDF to version 4.2.1, which patches the improper input validation in createAnnotation to prevent arbitrary PDF object injection.

SI-10 Information Input Validation good match

prevent

Information input validation enforces sanitization of user-controlled arguments like the color parameter before passing to createAnnotation, directly blocking injection of JavaScript actions.

SA-22 Unsupported System Components good match

prevent

Prohibiting unsupported jsPDF versions prior to 4.2.1 prevents deployment of components vulnerable to this input validation flaw.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

T1566.001 Spearphishing Attachment Initial Access

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Vulnerability enables generation of PDFs containing injected JavaScript actions via unsanitized input to createAnnotation; resulting malicious PDF files execute JS on open (T1204.002), are commonly delivered via spearphishing attachments (T1566.001), and leverage JavaScript for execution (T1059.007).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input…

to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.

Deeper analysisAI

CVE-2026-31898 is an improper input validation vulnerability in the jsPDF JavaScript library, which generates PDFs in browser or Node.js environments. Versions prior to 4.2.1 are affected, specifically in the `createAnnotation` method where user-controlled arguments, such as the `color` parameter, enable injection of arbitrary PDF objects including JavaScript actions. This stems from CWE-116 (Improper Encoding or Escaping of Output) and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The issue was published on 2026-03-18.

An attacker can exploit this vulnerability by providing malicious, unsanitized input to the `createAnnotation` method during PDF generation. No privileges are required, and exploitation is network-accessible with low complexity, but it demands user interaction, such as a developer or end-user processing the tainted input. Successful injection embeds JavaScript actions in the resulting PDF, which can execute upon opening or interacting with the document, potentially compromising confidentiality and integrity through actions like data exfiltration or unauthorized modifications.

The vulnerability is fixed in jsPDF version 4.2.1, as detailed in the project's release notes, fix commit, and security advisory (GHSA-7x6v-j9x4-qf24). Mitigation involves updating to the patched version; as a workaround, sanitize all user input before passing it to the `createAnnotation` method or related APIs. Source code affected areas are in `src/modules/annotations.js` lines 193-208.