CVE-2026-24043

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-240449.2Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. Th CVE-2026-240455.4Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in CVE-2026-240467.1Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable CVE-2026-240476.3Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the b CVE-2026-240483.7Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setu CVE-2026-240495.5wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack funct CVE-2026-24056.5CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of se CVE-2026-240505.4Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible t CVE-2026-240517.0OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacki CVE-2026-240527.4Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain ver CVE-2026-240536.5Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was CVE-2026-2405410.0Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like cont