A critical vulnerability in jsPDF – one of the most widely used JavaScript libraries for generating PDF files – lets an attacker inject malicious scripts into a victim’s browser session by poisoning how the library opens PDFs in a new window. The flaw, tracked as CVE-2026-31938 and carrying a CVSS score of 9.6 out of 10, was patched Tuesday.
Security professionals are urging affected businesses to update to jsPDF library immediately.
To trigger the exploit an attacker need only convince a target to open a maliciously configured PDF in a web browser instance on a privileged network such as a billing portal. Opening the PDF within a browser tab launches a script that can hijack session credentials and send them to an attacker.
The vulnerability was disclosed publicly on Tuesday via GitHub Security Advisories by researcher Lukas Holländer, who goes by the handle HackbrettXXX.
“[The exploited flaw] allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in,” Holländer wrote.
The patch requires developers who have built apps using the jsPDF library to update impacted applications. The jsPDF downloads logs roughly 13 million Node Package Manager (NPS) downloads per week. More than 2,200 packages depend on it directly. It powers a variety of applications ranging from invoice generators, report dashboards, document export features, and SaaS tools.
Security professionals recommend avoiding opening PDFs generated by web apps in a new browser tab if you are not certain the app has been recently updated. Where possible, download the PDF file to your device instead and open it in a dedicated PDF reader such as Adobe Acrobat. A downloaded file opened locally does not execute browser-based scripts and is not susceptible to this attack.
Malicious PDF in Action
The vulnerable library is a JavaScript tool developers use to build PDF generation directly into web applications — things like invoice exports, report downloads, and document builders. The tool accepts options from the application, including the filename of the PDF and the URL of the viewer used to display it.
The library passes those options directly into generated HTML without sanitizing them first. Sanitization means checking and cleaning user input before trusting it, like a bouncer checking IDs at the door.
An attacker who controls that input – say, through a form field on a web application – can slip in a crafted string that breaks out of the expected HTML structure and injects a hidden script. When the app generates the PDF and opens it in a new browser tab, that script executes silently in the victim’s browser. The attacker can then steal session tokens – the digital keys that keep users logged into a website – read sensitive data, or perform actions as the logged-in user.
The full attack chain: an attacker submits a malicious filename via a web interface. The app passes it unchecked into the PDF generator. The victim opens the resulting PDF in a new browser tab. The script runs. The session is compromised.
No attacker login is required. The victim only needs to open the PDF.
