Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in [email protected].
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 html2pdfjs, Cross-Site Scripting, #CVE-2026-22787 (High) https://dailycve.com/html2pdfjs-cross-site-scripting-cve-2026-22787-high/
Post summary
The text announces CVE‑2026‑22787, a high‑severity cross‑site scripting flaw in html2pdfjs, but provides no details on exploitation, patches, or proof‑of‑concept.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ekoopmans | html2pdf.js | - | node.js | - |