Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in [email protected].
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24043 XMP Metadata Injection Vulnerability in jsPDF Library Prior to 4.1.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24043
Post summary
The text announces a new XMP metadata injection flaw in jsPDF library versions before 4.1.0, with no evidence of PoC, exploitation, or patches.
CVE-2026-24043 jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML… https://www.cve.org/CVERecord?id=CVE-2026-24043
Post summary
The CVE-2026-24043 vulnerability in jsPDF allows users to inject arbitrary XML via the addMetadata function in versions prior to 4.1.0, indicating a potential injection flaw.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parall | jspdf | - | node.js | - |