Security vulnerabilities and automated fixes for jspdf issues
2 posts found
CVE-2025-68428 is a critical Local File Inclusion/Path Traversal vulnerability in jsPDF versions prior to 4.0.0 that could allow attackers to read arbitrary files from the server's filesystem through unsanitized path inputs during PDF generation. The vulnerability was present in the `jspdf` dependency declared in `frontend/package-lock.json`, and was resolved by upgrading from version 3.0.4 to 4.0.0. Left unpatched, this flaw could expose sensitive server-side files to unauthorized access via cr
CVE-2026-31938 is a critical cross-site scripting vulnerability in jsPDF versions prior to 4.2.1, where unsanitized output options could allow attackers to inject malicious scripts into PDF generation workflows. The fix upgrades jsPDF from 3.0.4 to 4.2.1 in both `package.json` and `pnpm-lock.yaml`, closing the attack surface in Handsontable's export-to-PDF feature. Developers using jsPDF in any web application should upgrade immediately, as this vulnerability is assessed as likely exploitable.