jsPDF に New Window パスにおける HTML インジェクションの脆弱性があります

The vulnerability stems from a lack of proper sanitization of user-controlled input within the options parameter of the output function. Specifically, the pdfobjectnewwindow, pdfjsnewwindow, and dataurlnewwindow options are vulnerable. An attacker can craft malicious values for pdfObjectUrl, pdfJsUrl, filename, or the entire options object (which is JSON-serialized) to inject arbitrary HTML, including JavaScript, into the PDF viewer's context. This injected script can then execute in the user's browser, allowing the attacker to steal cookies, redirect the user to a malicious website, or perform other actions on their behalf. The blast radius is significant, as any application using the vulnerable version of jspdf to generate PDFs could be exploited.

Applications that utilize the jspdf library to generate PDFs are at risk, particularly those that accept user-provided data to customize the PDF content. This includes web applications, desktop applications, and any other software that integrates with jspdf. Shared hosting environments where multiple applications share the same Node.js environment are also at increased risk, as a vulnerability in one application could potentially compromise others.

• nodejs / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*node*'} | Select-Object Name, Id, Path

• nodejs / supply-chain:

Get-ChildItem -Path Env:NODE_PATH -Recurse -Filter "jspdf*" | Select-Object FullName

• generic web: Use curl or wget to check for endpoints that generate PDFs and attempt to inject HTML payloads into parameters related to PDF options. Examine the generated PDF file for signs of injected script.

1. 2026-03-17Disclosure

   disclosure

1. 予約済み2026-03-10
2. 公開日2026-03-17
3. 更新日2026-03-19
4. EPSS 更新日2026-03-25

The primary mitigation is to upgrade to jspdf version 4.2.1 or later, which includes a fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the options parameter before passing it to the output function. While not a complete solution, this can reduce the attack surface. Additionally, consider using a Web Application Firewall (WAF) to filter out potentially malicious requests targeting the PDF generation endpoint. Monitor application logs for unusual activity or attempts to manipulate the PDF generation process. After upgrading, confirm the fix by attempting to generate a PDF with a crafted payload containing HTML tags and verifying that the tags are properly escaped or removed.