{"id":1216449,"name":"jspdf","ecosystem":"npm","description":"PDF Document creation from JavaScript","homepage":"https://github.com/parallax/jsPDF","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/parallax/jsPDF","keywords_array":["pdf"],"namespace":null,"versions_count":34,"first_release_published_at":"2015-05-19T00:28:59.608Z","latest_release_published_at":"2026-03-17T11:16:14.226Z","latest_release_number":"4.2.1","latest_published_release_number":"4.2.1","last_synced_at":"2026-10-24T09:02:50.107Z","created_at":"2022-04-08T13:56:26.270Z","updated_at":"2026-10-24T11:46:20.120Z","registry_url":"https://www.npmjs.com/package/jspdf","install_command":"npm install jspdf","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"4.2.1"},"contentPolicy":null},"repo_metadata":{"id":749824,"uuid":"402046","full_name":"parallax/jsPDF","owner":"parallax","description":"Client-side JavaScript PDF generation for everyone.","archived":false,"fork":false,"pushed_at":"2026-09-30T20:48:08.000Z","size":144323,"stargazers_count":31310,"open_issues_count":115,"forks_count":4794,"subscribers_count":475,"default_branch":"master","last_synced_at":"2026-10-16T17:06:57.085Z","etag":null,"topics":["hacktoberfest"],"latest_commit_sha":null,"homepage":"https://parall.ax/products/jspdf","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/parallax.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2009-12-06T14:56:32.000Z","updated_at":"2026-10-15T22:40:01.000Z","dependencies_parsed_at":"2026-10-02T21:14:18.356Z","dependency_job_id":null,"html_url":"https://github.com/parallax/jsPDF","commit_stats":{"total_commits":1900,"total_committers":210,"mean_commits":9.047619047619047,"dds":0.7378947368421053,"last_synced_commit":"f60dcfad962dd73fd1a4192b726833a9d70b3fbc"},"previous_names":["mrrio/jspdf"],"tags_count":45,"template":false,"template_full_name":null,"purl":"pkg:github/parallax/jsPDF","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/parallax","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344836268,"owners_count":38331817,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-16T02:00:06.653Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"parallax","name":"Parallax","uuid":"320004","kind":"organization","description":"","email":"info@parall.ax","website":"https://parall.ax/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/320004?v=4","repositories_count":128,"last_synced_at":"2026-10-21T01:40:30.028Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/parallax","funding_links":[],"total_stars":31930,"followers":117,"following":0,"created_at":"2022-11-03T02:47:41.396Z","updated_at":"2026-10-21T01:40:30.038Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/parallax","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/parallax/repositories"},"tags":[{"name":"v4.2.1","sha":"4562ce8aa35bd5ecd98cd5e262e3da2af96476f6","kind":"commit","published_at":"2026-03-17T11:15:15.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v4.2.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v4.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.2.1/manifests"},{"name":"v4.2.0","sha":"7af912cadaf0f9a2ad28afe7af53033a2c61de64","kind":"commit","published_at":"2026-02-19T10:01:19.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v4.2.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.2.0/manifests"},{"name":"v4.1.0","sha":"02273814bf0222eda02944f9a14128811f3b5a33","kind":"commit","published_at":"2026-02-02T10:45:04.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v4.1.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.1.0/manifests"},{"name":"v4.0.0","sha":"e6cf03db2499ef0a9ccc54b2aba45156c5b32b3c","kind":"commit","published_at":"2025-12-18T10:31:03.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v4.0.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v4.0.0/manifests"},{"name":"v3.0.4","sha":"a504e973eeebac633351b41860945ca2a2cdf096","kind":"commit","published_at":"2025-11-19T13:32:37.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v3.0.4","html_url":"https://github.com/parallax/jsPDF/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.4/manifests"},{"name":"v3.0.3","sha":"574a9410524b68f8f122c84142d20fb9e9d9a6ef","kind":"commit","published_at":"2025-09-18T08:08:30.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v3.0.3","html_url":"https://github.com/parallax/jsPDF/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"543b356c321a7e13f08d4cb3d1f247e8b130a871","kind":"commit","published_at":"2025-08-26T11:57:01.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v3.0.2","html_url":"https://github.com/parallax/jsPDF/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"57cbe9499dc9922c1a8dbdd225f9c45364653324","kind":"commit","published_at":"2025-03-17T14:25:06.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v3.0.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"d0c605f1f19369fbcb0ec3bd4979877af4f8bbf1","kind":"commit","published_at":"2025-02-19T09:33:14.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v3.0.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v3.0.0/manifests"},{"name":"v2.5.2","sha":"caf51599f4fd6f608684b4347e1e22f1c403ae87","kind":"commit","published_at":"2024-09-17T13:35:40.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.5.2","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.2/manifests"},{"name":"v2.5.1","sha":"7315ccbb54fdf47a3498cfb3c9f757da5c450242","kind":"commit","published_at":"2022-01-28T15:55:26.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.5.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.1/manifests"},{"name":"v2.5.0","sha":"edd59d892d2b717f109230cddb4dc82938292285","kind":"commit","published_at":"2021-12-21T09:57:10.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.5.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.5.0/manifests"},{"name":"v2.4.0","sha":"30880b41475c587dc3a0182f980883395ea638e7","kind":"commit","published_at":"2021-09-14T11:33:44.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.4.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.4.0/manifests"},{"name":"v2.3.1","sha":"9b8f1e962cbf0e886cdead7cf8a9d614943838eb","kind":"commit","published_at":"2021-03-09T08:42:52.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.3.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.3.1/manifests"},{"name":"v2.3.0","sha":"63f89d47d1cd60091e62d6d51570f78f27d01a23","kind":"commit","published_at":"2021-01-15T16:09:15.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.3.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.3.0/manifests"},{"name":"v2.2.0","sha":"f2c578fd179d1a6be2d37adf7e5e914c902bcf56","kind":"commit","published_at":"2020-12-07T14:48:04.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.2.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.2.0/manifests"},{"name":"v2.1.1","sha":"550ad8bdc64ec96351c806f90401e528af6e0554","kind":"commit","published_at":"2020-09-07T13:53:44.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.1.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.1.1/manifests"},{"name":"v2,1,0","sha":"dd6bdddd19fab2b399e7e15693c8664d673a52b3","kind":"commit","published_at":"2020-08-25T16:09:04.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2,1,0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2,1,0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2%2C1%2C0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2,1,0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2,1,0/manifests"},{"name":"v2.0.0","sha":"4497d22f4bcbcc794cc8364e26b1986d787ed753","kind":"commit","published_at":"2020-08-11T08:54:04.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v2.0.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v2.0.0/manifests"},{"name":"v1.5.3","sha":"f14bac45183666e0f4ec0eb3333b8e761cb0288a","kind":"tag","published_at":"2018-12-27T14:11:53.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.5.3","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.3/manifests"},{"name":"v1.5.2","sha":"5b6937a82b4779b6637ffce1ac2bd1c1ff4d037d","kind":"tag","published_at":"2018-12-20T15:49:11.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.5.2","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.2/manifests"},{"name":"v1.5.1","sha":"83b45510abbce26f5a2fd2d01112f89a80b031f7","kind":"tag","published_at":"2018-12-20T15:41:58.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.5.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.1/manifests"},{"name":"v1.5.0","sha":"ca72cf5baf65ba1b70c1a3258aab9eb7a78c1ea6","kind":"commit","published_at":"2018-12-20T01:03:24.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.5.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.5.0/manifests"},{"name":"v1.4.1","sha":"eb6f0424855fc5cf790178572a19f277e1ca5107","kind":"tag","published_at":"2018-06-06T07:50:19.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.4.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"16887f832521767aa662d512298126bb2d600cf4","kind":"tag","published_at":"2018-05-21T16:49:19.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.4.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.4.0/manifests"},{"name":"v.1.4.0","sha":"16887f832521767aa662d512298126bb2d600cf4","kind":"commit","published_at":"2018-05-21T16:49:19.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v.1.4.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v.1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v.1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v.1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v.1.4.0/manifests"},{"name":"v1.3.5","sha":"626d79aab76d85ae987f88081f7aabb7c1f2e61c","kind":"tag","published_at":"2017-09-14T15:10:12.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.5","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.5/manifests"},{"name":"v1.3.4","sha":"938a6bcfc8468ff383c2a02e50e6e3022ff253bd","kind":"tag","published_at":"2017-07-29T08:05:36.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.4","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.4/manifests"},{"name":"1.3.4","sha":"aac406f626e0af075f3024cd8738f3c2182e450b","kind":"commit","published_at":"2017-03-21T16:34:30.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/1.3.4","html_url":"https://github.com/parallax/jsPDF/releases/tag/1.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@1.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/1.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/1.3.4/manifests"},{"name":"v1.3.3","sha":"ac12a246456496d509be585d0fa504da55aef96e","kind":"tag","published_at":"2017-02-23T15:31:31.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.3","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.3/manifests"},{"name":"v1.3.2","sha":"5a5f4b6fb4221edb6da147de3fb9500fe886805b","kind":"tag","published_at":"2016-09-30T20:33:19.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.2","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.2/manifests"},{"name":"v1.3.1","sha":"7d854cc77ddf6006d2928d57c2788f4bebaf9ddf","kind":"tag","published_at":"2016-09-30T20:23:52.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.1","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"32d2675cf566feaece7747e429880495baba6bdf","kind":"tag","published_at":"2016-09-28T10:52:42.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.3.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.3.0/manifests"},{"name":"v1.2.61","sha":"5e8bd00e640653048554e9474f157ba4479dd669","kind":"commit","published_at":"2016-03-01T16:16:40.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.2.61","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.2.61","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.2.61","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.2.61","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.2.61/manifests"},{"name":"v1.2.60","sha":"04343b54b04a573512abe948cd80ef9a86c271a8","kind":"commit","published_at":"2016-02-29T18:47:43.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.2.60","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.2.60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.2.60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.2.60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.2.60/manifests"},{"name":"1.1.135","sha":"653f94aa5188b5eed26c355da21c78b7c048c877","kind":"commit","published_at":"2015-05-15T23:15:47.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/1.1.135","html_url":"https://github.com/parallax/jsPDF/releases/tag/1.1.135","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@1.1.135","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/1.1.135","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/1.1.135/manifests"},{"name":"v1.0.272","sha":"43eb0811568aae12c5258326921d7cda06424d59","kind":"tag","published_at":"2014-09-29T15:10:09.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.272","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.272","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.272","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.272","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.272/manifests"},{"name":"v1.0.178","sha":"da257c28e70df11e68e9887ddf0dab7bb19902f5","kind":"tag","published_at":"2014-06-27T15:34:55.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.178","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.178","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.178","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.178","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.178/manifests"},{"name":"v1.0.150","sha":"75d18af849972d8826b7b0c5e6b65c7d868803a1","kind":"tag","published_at":"2014-05-30T00:40:56.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.150","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.150","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.150","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.150","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.150/manifests"},{"name":"v1.0.138","sha":"aed93c35eff51a0c032627af3241b5f2c4311fc7","kind":"tag","published_at":"2014-05-18T18:43:08.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.138","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.138","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.138","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.138","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.138/manifests"},{"name":"v1.0.119","sha":"4c6949394c1ffaf86d448e5e962f315559deb000","kind":"tag","published_at":"2014-04-29T03:49:14.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.119","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.119","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.119","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.119","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.119/manifests"},{"name":"v1.0.116","sha":"b24434864dc733386e02e7862d0eacc361edcf15","kind":"tag","published_at":"2014-04-26T23:34:00.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.116","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.116","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.116","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.116","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.116/manifests"},{"name":"v1.0.115","sha":"aec0c91d0872f899f9f1851991324bcb008bc6ed","kind":"commit","published_at":"2014-04-25T10:38:58.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.115","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.115","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.115","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.115","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.115/manifests"},{"name":"v1.0.106","sha":"22e8b4c99f168e4738ba72d1b951cf981a002f6d","kind":"commit","published_at":"2014-04-24T20:33:54.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v1.0.106","html_url":"https://github.com/parallax/jsPDF/releases/tag/v1.0.106","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v1.0.106","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.106","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v1.0.106/manifests"},{"name":"v0.9.0","sha":"4fc26f526b08ab3df79ea80ae1dd5cef74c773dc","kind":"tag","published_at":"2014-02-08T10:53:54.000Z","download_url":"https://codeload.github.com/parallax/jsPDF/tar.gz/v0.9.0","html_url":"https://github.com/parallax/jsPDF/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/parallax/jsPDF@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/tags/v0.9.0/manifests"}]},"repo_metadata_updated_at":"2026-10-24T11:46:20.120Z","dependent_packages_count":1518,"downloads":63729354,"downloads_period":"last-month","dependent_repos_count":21994,"rankings":{"downloads":0.14791147275554042,"dependent_repos_count":0.19804900598890535,"dependent_packages_count":0.055829753176143734,"stargazers_count":0.5600511954811823,"forks_count":0.5360461265305747,"docker_downloads_count":0.21285452755724418,"average":0.2851236802482651},"purl":"pkg:npm/jspdf","advisories":[{"uuid":"GSA_kwCzR0hTQS13ZnYyLXB3YzgtY3JnNc4ABTwQ","url":"https://github.com/advisories/GHSA-wfv2-pwc8-crg5","title":"jsPDF has HTML Injection in New Window paths","description":"### Impact\n\nUser control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:\n\n* `\"pdfobjectnewwindow\"`: the `pdfObjectUrl` option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.\n* `\"pdfjsnewwindow\"`: the `pdfJsUrl` and `filename` options\n* `\"dataurlnewwindow\"`: the `filename` option\n\nThe vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from 'jspdf';\nconst doc = new jsPDF();\n\nconst payload =  'x\\\"\u003e\u003c/iframe\u003e\u003cscript\u003ewindow.__n=1\u003c/script\u003e\u003ciframe src=\"';\n\ndoc.output('pdfjsnewwindow', {\n  filename: payload,\n  pdfJsUrl: 'viewer.html'\n});\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.1.\n\n### Workarounds\nSanitize user input before passing it to the output method.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-17T17:07:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.6,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5","https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7","https://github.com/parallax/jsPDF/releases/tag/v4.2.1","https://nvd.nist.gov/vuln/detail/CVE-2026-31938","https://github.com/advisories/GHSA-wfv2-pwc8-crg5"],"source_kind":"github","identifiers":["GHSA-wfv2-pwc8-crg5","CVE-2026-31938"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-17T18:00:09.209Z","updated_at":"2026-10-16T06:04:51.974Z","epss_percentage":0.0042,"epss_percentile":0.34755,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13ZnYyLXB3YzgtY3JnNc4ABTwQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13ZnYyLXB3YzgtY3JnNc4ABTwQ","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.2.1","vulnerable_version_range":"\u003c= 4.2.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13ZnYyLXB3YzgtY3JnNc4ABTwQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03eDZ2LWo5eDQtcWYyNM4ABTwP","url":"https://github.com/advisories/GHSA-7x6v-j9x4-qf24","title":"jsPDF has a PDF Object Injection via FreeText color","description":"### Impact\n\nUser control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions.\n\nIf given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..\n\n* `createAnnotation`: `color` parameter\n\nExample attack vector:\n\n```js\nimport { jsPDF } from 'jspdf'\n\nconst doc = new jsPDF();\n\nconst payload = '000000) /AA \u003c\u003c/E \u003c\u003c/S /Launch /F (calc.exe)\u003e\u003e\u003e\u003e (';\n\ndoc.createAnnotation({\n  type: 'freetext',\n  bounds: { x: 10, y: 10, w: 120, h: 20 },\n  contents: 'hello',\n  color: payload\n});\n\ndoc.save('test.pdf');\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.2.1.\n\n### Workarounds\nSanitize user input before passing it to the vulnerable API members.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-17T17:07:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24","https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8","https://github.com/parallax/jsPDF/releases/tag/v4.2.1","https://nvd.nist.gov/vuln/detail/CVE-2026-31898","https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208","https://github.com/advisories/GHSA-7x6v-j9x4-qf24"],"source_kind":"github","identifiers":["GHSA-7x6v-j9x4-qf24","CVE-2026-31898"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-17T18:00:09.210Z","updated_at":"2026-10-16T06:04:51.974Z","epss_percentage":0.00644,"epss_percentile":0.4979,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03eDZ2LWo5eDQtcWYyNM4ABTwP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03eDZ2LWo5eDQtcWYyNM4ABTwP","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.2.1","vulnerable_version_range":"\u003c= 4.2.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03eDZ2LWo5eDQtcWYyNM4ABTwP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wNXhnLTY4d3ItaG0zbc4ABSmY","url":"https://github.com/advisories/GHSA-p5xg-68wr-hm3m","title":"jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and \"AS\" property)","description":"### Impact\n\nUser control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.\n\nIf given the possibility to pass unsanitized input to the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option.\n\n* `AcroformChildClass.appearanceState`\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\"\nconst doc = new jsPDF();\n\nconst group = new doc.AcroFormRadioButton();\ngroup.x = 10; group.y = 10; group.width = 20; group.height = 10;\ndoc.addField(group);\n\nconst child = group.createOption(\"opt1\");\nchild.x = 10; child.y = 10; child.width = 20; child.height = 10;\nchild.appearanceState = \"Off /AA \u003c\u003c /E \u003c\u003c /S /JavaScript /JS (app.alert('XSS')) \u003e\u003e \u003e\u003e\";\n\ndoc.save(\"test.pdf\");\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.2.0.\n\n### Workarounds\nSanitize user input before passing it to the vulnerable API members.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-19T19:32:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-p5xg-68wr-hm3m","https://nvd.nist.gov/vuln/detail/CVE-2026-25940","https://github.com/parallax/jsPDF/commit/71ad2dbfa6c7c189ab42b855b782620fa8a38375","https://github.com/parallax/jsPDF/releases/tag/v4.2.0","https://github.com/advisories/GHSA-p5xg-68wr-hm3m"],"source_kind":"github","identifiers":["GHSA-p5xg-68wr-hm3m","CVE-2026-25940"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-19T20:00:07.678Z","updated_at":"2026-10-18T11:13:03.104Z","epss_percentage":0.00718,"epss_percentile":0.52918,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNXhnLTY4d3ItaG0zbc4ABSmY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNXhnLTY4d3ItaG0zbc4ABSmY","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.2.0","vulnerable_version_range":"\u003c 4.2.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNXhnLTY4d3ItaG0zbc4ABSmY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05dmpmLXFjMzktanBycM4ABSmX","url":"https://github.com/advisories/GHSA-9vjf-qc39-jprp","title":"jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method","description":"### Impact\n\nUser control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.\n\n```js\nimport { jsPDF } from \"jspdf\";\nconst doc = new jsPDF();\n// Payload:\n// 1. ) closes the JS string.\n// 2. \u003e closes the current dictionary.\n// 3. /AA ... injects an \"Additional Action\" that executes on focus/open.\nconst maliciousPayload = \"console.log('test');) \u003e\u003e /AA \u003c\u003c /O \u003c\u003c /S /JavaScript /JS (app.alert('Hacked!')) \u003e\u003e \u003e\u003e\";\n\ndoc.addJS(maliciousPayload);\ndoc.save(\"vulnerable.pdf\");\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.2.0.\n\n### Workarounds\nEscape parentheses in user-provided JavaScript code before passing them to the `addJS` method.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-19T19:32:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-9vjf-qc39-jprp","https://nvd.nist.gov/vuln/detail/CVE-2026-25755","https://github.com/parallax/jsPDF/commit/56b46d45b052346f5995b005a34af5dcdddd5437","https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md","https://github.com/parallax/jsPDF/releases/tag/v4.2.0","https://github.com/advisories/GHSA-9vjf-qc39-jprp"],"source_kind":"github","identifiers":["GHSA-9vjf-qc39-jprp","CVE-2026-25755"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-19T20:00:07.678Z","updated_at":"2026-10-18T11:13:03.104Z","epss_percentage":0.00918,"epss_percentile":0.59526,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05dmpmLXFjMzktanBycM4ABSmX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05dmpmLXFjMzktanBycM4ABSmX","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.2.0","vulnerable_version_range":"\u003c 4.2.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05dmpmLXFjMzktanBycM4ABSmX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02N3BnLXdtN2YtcTdmas4ABShs","url":"https://github.com/advisories/GHSA-67pg-wm7f-q7fj","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"### Impact\n\nUser control of the first argument of the `addImage` method results in denial of service.\n\nIf given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.\n\nOther affected methods are: `html`.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\n// malicious GIF image data with large width/height headers\nconst payload = ...\n\nconst doc = new jsPDF();\n\ndoc.addImage(payload, \"GIF\", 0, 0, 100, 100);\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@\u003e=4.2.0.\n\n### Workarounds\n\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-19T15:25:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj","https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5e6","https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","https://github.com/parallax/jsPDF/releases/tag/v4.2.0","https://nvd.nist.gov/vuln/detail/CVE-2026-25535","https://github.com/advisories/GHSA-67pg-wm7f-q7fj"],"source_kind":"github","identifiers":["GHSA-67pg-wm7f-q7fj","CVE-2026-25535"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-19T16:00:09.010Z","updated_at":"2026-10-18T11:13:03.107Z","epss_percentage":0.01026,"epss_percentile":0.62972,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02N3BnLXdtN2YtcTdmas4ABShs","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02N3BnLXdtN2YtcTdmas4ABShs","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.2.0","vulnerable_version_range":"\u003c 4.2.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02N3BnLXdtN2YtcTdmas4ABShs/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcXhyLTNnNjUtcDMyOM4ABRzQ","url":"https://github.com/advisories/GHSA-pqxr-3g65-p328","title":"jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution","description":"### Impact\n\nUser control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.\n\nIf given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are:\n\n* `AcroformChoiceField.addOption`\n* `AcroformChoiceField.setOptions`\n* `AcroFormCheckBox.appearanceState`\n* `AcroFormRadioButton.appearanceState`\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\"\nconst doc = new jsPDF();\n\nvar choiceField = new doc.AcroFormChoiceField();\nchoiceField.T = \"VulnerableField\";\nchoiceField.x = 20;\nchoiceField.y = 20;\nchoiceField.width = 100;\nchoiceField.height = 20;\n\n// PAYLOAD:\n// 1. Starts with \"/\" to bypass escaping.\n// 2. \"dummy]\" closes the array.\n// 3. \"/AA\" injects an Additional Action (Focus event).\n// 4. \"/JS\" executes arbitrary JavaScript.\nconst payload = \"/dummy] /AA \u003c\u003c /Fo \u003c\u003c /S /JavaScript /JS (app.alert('XSS')) \u003e\u003e \u003e\u003e /Garbage [\";\n\nchoiceField.addOption(payload);\ndoc.addField(choiceField);\n\ndoc.save(\"test.pdf\");\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.1.0.\n\n### Workarounds\nSanitize user input before passing it to the vulnerable API members.\n\n### Credits\nResearch and fix: Ahmet Artuç","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-02T18:29:49.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328","https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79","https://nvd.nist.gov/vuln/detail/CVE-2026-24737","https://github.com/parallax/jsPDF/releases/tag/v4.1.0","https://github.com/advisories/GHSA-pqxr-3g65-p328"],"source_kind":"github","identifiers":["GHSA-pqxr-3g65-p328","CVE-2026-24737"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-02T19:00:07.583Z","updated_at":"2026-10-18T11:13:39.503Z","epss_percentage":0.00598,"epss_percentile":0.47514,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcXhyLTNnNjUtcDMyOM4ABRzQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcXhyLTNnNjUtcDMyOM4ABRzQ","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.1.0","vulnerable_version_range":"\u003c= 4.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcXhyLTNnNjUtcDMyOM4ABRzQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05NWZ4LWpqcjUtZjM5Y84ABRzP","url":"https://github.com/advisories/GHSA-95fx-jjr5-f39c","title":"jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder","description":"### Impact\n\nUser control of the first argument of the `addImage` method results in Denial of Service.\n\nIf given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, wich lead to excessive memory allocation.\n\nOther affected methods are: `html`.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\n// malicious BMP image data with large width/height headers\nconst payload = ...\n\nconst doc = new jsPDF();\n\ndoc.addImage(payload, \"BMP\", 0, 0, 100, 100);\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF 4.1.0. Upgrade to jspdf@\u003e=4.1.0.\n\n### Workarounds\n\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-02T18:29:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c","https://github.com/parallax/jsPDF/commit/ae4b93f76d8fc1baa5614bd5fdb5d174c3b85f0d","https://nvd.nist.gov/vuln/detail/CVE-2026-24133","https://github.com/parallax/jsPDF/releases/tag/v4.1.0","https://github.com/advisories/GHSA-95fx-jjr5-f39c"],"source_kind":"github","identifiers":["GHSA-95fx-jjr5-f39c","CVE-2026-24133"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-02T19:00:07.583Z","updated_at":"2026-10-12T12:07:50.747Z","epss_percentage":0.00626,"epss_percentile":0.48535,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NWZ4LWpqcjUtZjM5Y84ABRzP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05NWZ4LWpqcjUtZjM5Y84ABRzP","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.1.0","vulnerable_version_range":"\u003c= 4.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NWZ4LWpqcjUtZjM5Y84ABRzP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12bTMyLXZ2NjMtdzQyMs4ABRzO","url":"https://github.com/advisories/GHSA-vm32-vv63-w422","title":"jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing \u0026 Integrity Violation)","description":"### Impact\n\nUser control of the first argument of the `addMetadata` function allows users to inject arbitrary XML.\n\nIf given the possibility to pass unsanitized input to the `addMetadata` method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\"\n\nconst doc = new jsPDF()\n\n// Input a string that closes the current XML tag and opens a new one.\n// We are injecting a fake \"dc:creator\" (Author) to spoof the document source.\nconst maliciousInput = '\u003c/jspdf:metadata\u003e\u003c/rdf:Description\u003e' +\n    '\u003crdf:Description xmlns:dc=\"http://purl.org/dc/elements/1.1/\"\u003e' +\n    '\u003cdc:creator\u003eTRUSTED_ADMINISTRATOR\u003c/dc:creator\u003e' + // \u003c--- Spoofed Identity\n    '\u003c/rdf:Description\u003e' +\n    '\u003crdf:Description\u003e\u003cjspdf:metadata\u003e'\n\n// The application innocently adds the user's input to the metadata\ndoc.addMetadata(maliciousInput, \"http://valid.namespace\")\n\ndoc.save(\"test.pdf\")\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF@4.1.0\n\n### Workarounds\n\nSanitize user input before passing it to the `addMetadata` method: escape XML entities. For example:\n\n```js\nlet input = \"...\"\n\ninput = input\n    .replace(/\u0026/g, \"\u0026amp;\")\n    .replace(/\u003c/g, \"\u0026lt;\")\n    .replace(/\u003e/g, \"\u0026gt;\")\n    .replace(/\"/g, \"\u0026quot;\")\n    .replace(/'/g, \"\u0026apos;\")\n\ndoc.addMetadata(input)\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-02T18:28:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-vm32-vv63-w422","https://github.com/parallax/jsPDF/commit/efe54bf50f3f5e5416b2495e3c24624fc80b6cff","https://nvd.nist.gov/vuln/detail/CVE-2026-24043","https://github.com/parallax/jsPDF/releases/tag/v4.1.0","https://github.com/advisories/GHSA-vm32-vv63-w422"],"source_kind":"github","identifiers":["GHSA-vm32-vv63-w422","CVE-2026-24043"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-02T19:00:07.583Z","updated_at":"2026-10-14T10:06:42.033Z","epss_percentage":0.00295,"epss_percentile":0.20512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTMyLXZ2NjMtdzQyMs4ABRzO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12bTMyLXZ2NjMtdzQyMs4ABRzO","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.1.0","vulnerable_version_range":"\u003c= 4.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTMyLXZ2NjMtdzQyMs4ABRzO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1janc4LTc5eDYtNWNqNM4ABRzN","url":"https://github.com/advisories/GHSA-cjw8-79x6-5cj4","title":"jsPDF has Shared State Race Condition in addJS Plugin","description":"### Impact\n\nThe addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.\n\nIf multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B.\n\nTypically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side.\n\n```js\nimport { jsPDF } from \"jspdf\";\n\nconst docA = new jsPDF();\nconst docB = new jsPDF();\n\n// 1. User A sets their script (stored in shared 'text' variable)\ndocA.addJS('console.log(\"Secret A\");');\n\n// 2. User B sets their script (overwrites shared 'text' variable)\ndocB.addJS('console.log(\"Secret B\");');\n\n// 3. User A saves their PDF (reads current 'text' variable)\ndocA.save(\"userA.pdf\");\n\n// Result: userA.pdf contains \"Secret B\" instead of \"Secret A\"\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.0.1. The fix moves the shared variable into the function scope, ensuring isolation between instances.\n\n### Workarounds\nAvoid using the addJS method in concurrent server-side environments. If usage is required, ensure requests are processed sequentially (e.g., using a queue) rather than in parallel.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-02T18:20:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4","https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e","https://nvd.nist.gov/vuln/detail/CVE-2026-24040","https://github.com/parallax/jsPDF/releases/tag/v4.1.0","https://github.com/advisories/GHSA-cjw8-79x6-5cj4"],"source_kind":"github","identifiers":["GHSA-cjw8-79x6-5cj4","CVE-2026-24040"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-02T19:00:07.583Z","updated_at":"2026-10-22T15:06:11.327Z","epss_percentage":0.00282,"epss_percentile":0.19573,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1janc4LTc5eDYtNWNqNM4ABRzN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1janc4LTc5eDYtNWNqNM4ABRzN","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.1.0","vulnerable_version_range":"\u003c= 4.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1janc4LTc5eDYtNWNqNM4ABRzN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mOGNtLTY0NDcteDVoMs4ABQsS","url":"https://github.com/advisories/GHSA-f8cm-6447-x5h2","title":"jsPDF has Local File Inclusion/Path Traversal vulnerability","description":"### Impact\nUser control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.\n\nIf given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs.\n\nOther affected methods are: `addImage`, `html`, `addFont`.\n\nOnly the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"./dist/jspdf.node.js\";\n\nconst doc = new jsPDF();\n\ndoc.addImage(\"./secret.txt\", \"JPEG\", 0, 0, 10, 10);\ndoc.save(\"test.pdf\"); // the generated PDF will contain the \"secret.txt\" file\n```\n\n### Patches\nThe vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes.\n\n### Workarounds\nWith recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. See the [node documentation](https://nodejs.org/api/permissions.html) for details.\n\nFor older node versions, sanitize user-provided paths before passing them to jsPDF.\n\n### Credits\nResearcher: kilkat (Kwangwoon Kim)","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-01-05T17:35:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2","https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d","https://github.com/parallax/jsPDF/releases/tag/v4.0.0","https://nvd.nist.gov/vuln/detail/CVE-2025-68428","https://github.com/advisories/GHSA-f8cm-6447-x5h2"],"source_kind":"github","identifiers":["GHSA-f8cm-6447-x5h2","CVE-2025-68428"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-05T18:00:08.915Z","updated_at":"2026-10-12T12:08:12.607Z","epss_percentage":0.02177,"epss_percentile":0.81548,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mOGNtLTY0NDcteDVoMs4ABQsS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mOGNtLTY0NDcteDVoMs4ABQsS","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"4.0.0","vulnerable_version_range":"\u003c= 3.0.4"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mOGNtLTY0NDcteDVoMs4ABQsS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04bXZqLTNqNzgtNHFtd84ABLcG","url":"https://github.com/advisories/GHSA-8mvj-3j78-4qmw","title":"jsPDF Denial of Service (DoS)","description":"### Impact\nUser control of the first argument of the addImage method results in CPU utilization and denial of service.\n\nIf given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service.\n\nOther affected methods are: `html`.\n\nExample payload:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\nconst payload = new Uint8Array([117, 171, 90, 253, 166, 154, 105, 166, 154])\n\nconst doc = new jsPDF();\nconst startTime = performance.now();\ntry {\n  doc.addImage(payload, \"PNG\", 10, 40, 180, 180, undefined, \"SLOW\");\n} finally {\n  const endTime = performance.now();\n  console.log(`Call to doc.addImage took ${endTime - startTime} milliseconds`);\n}\n```\n\n### Patches\nThe vulnerability was fixed in jsPDF 3.0.2. Upgrade to jspdf@\u003e=3.0.2.\n\nIn jspdf@\u003e=3.0.2, invalid PNG files throw an Error instead of causing very long running loops.\n\n### Workarounds\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.\n\n### Credits\nResearcher: Aleksey Solovev (Positive Technologies)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-08-26T16:19:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmw","https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9","https://nvd.nist.gov/vuln/detail/CVE-2025-57810","https://github.com/parallax/jsPDF/pull/3880","https://github.com/parallax/jsPDF/releases/tag/v3.0.2","https://github.com/advisories/GHSA-8mvj-3j78-4qmw"],"source_kind":"github","identifiers":["GHSA-8mvj-3j78-4qmw","CVE-2025-57810"],"repository_url":"https://github.com/parallax/jsPDF","blast_radius":37.77804672024843,"created_at":"2025-08-26T17:09:33.910Z","updated_at":"2026-10-22T15:07:22.315Z","epss_percentage":0.007,"epss_percentile":0.52561,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bXZqLTNqNzgtNHFtd84ABLcG","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04bXZqLTNqNzgtNHFtd84ABLcG","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"3.0.2","vulnerable_version_range":"\u003c= 3.0.1"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bXZqLTNqNzgtNHFtd84ABLcG/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13NTMyLWp4amgtaGpoas4ABFnt","url":"https://github.com/advisories/GHSA-w532-jxjh-hjhj","title":"jsPDF Bypass Regular Expression Denial of Service (ReDoS)","description":"### Impact\nUser control of the first argument of the `addImage` method results in CPU utilization and denial of service.\n\nIf given the possibility to pass unsanitized image urls to the `addImage` method, a user can provide a harmful data-url that results in high CPU utilization and denial of service.\n\nOther affected methods are: `html`, `addSvgAsImage`.\n\nExample payload:\n```js\nimport { jsPDF } from \"jpsdf\" \n\nconst doc = new jsPDF();\nconst payload = 'data:/charset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=s\\x00base64,undefined';\n\nconst startTime = performance.now()\n\ntry {\n doc.addImage(payload, \"PNG\", 10, 40, 180, 180, undefined, \"SLOW\");\n} catch (err) {\n  const endTime = performance.now()\n  console.log(`Call to doc.addImage took ${endTime - startTime} milliseconds`)\n}\n\ndoc.save(\"a4.pdf\");\n```\n\n### Patches\nThe vulnerability was fixed in jsPDF 3.0.1. Upgrade to jspdf@\u003e=3.0.1\n\n### Workarounds\nSanitize image urls before passing it to the `addImage` method or one of the other affected methods.\n\n### Credits\nResearcher: Aleksey Solovev (Positive Technologies)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-03-18T21:07:47.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj","https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df","https://nvd.nist.gov/vuln/detail/CVE-2025-29907","https://github.com/advisories/GHSA-w532-jxjh-hjhj"],"source_kind":"github","identifiers":["GHSA-w532-jxjh-hjhj","CVE-2025-29907"],"repository_url":"https://github.com/parallax/jsPDF","blast_radius":37.77804672024843,"created_at":"2025-03-18T22:07:27.103Z","updated_at":"2026-10-22T15:08:20.297Z","epss_percentage":0.00699,"epss_percentile":0.52534,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NTMyLWp4amgtaGpoas4ABFnt","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13NTMyLWp4amgtaGpoas4ABFnt","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"3.0.1","vulnerable_version_range":"\u003c 3.0.1"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NTMyLWp4amgtaGpoas4ABFnt/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNTktdjlyNS00bWg0","url":"https://github.com/advisories/GHSA-vh59-v9r5-4mh4","title":"Cross-site scripting in jspdf","description":"Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to inject JavaScript code via the `html` method.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-05-17T21:01:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-7690","https://github.com/MrRio/jsPDF/issues/2795","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-575260","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-575258","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-575259","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575257","https://snyk.io/vuln/SNYK-JS-JSPDF-575256","https://github.com/parallax/jsPDF/issues/2862","https://github.com/parallax/jsPDF/issues/2971","https://github.com/parallax/jsPDF/pull/2806","https://github.com/advisories/GHSA-vh59-v9r5-4mh4"],"source_kind":"github","identifiers":["GHSA-vh59-v9r5-4mh4","CVE-2020-7690"],"repository_url":"https://github.com/MrRio/jsPDF","blast_radius":0.0,"created_at":"2022-12-21T16:13:04.454Z","updated_at":"2026-10-12T12:18:35.685Z","epss_percentage":0.00968,"epss_percentile":0.60512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNTktdjlyNS00bWg0","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNTktdjlyNS00bWg0","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"2.0.0","vulnerable_version_range":"\u003c 2.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNTktdjlyNS00bWg0/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNxNmYtOGdyeC1wcjR2","url":"https://github.com/advisories/GHSA-3q6f-8grx-pr4v","title":"Cross-site scripting in jspdf","description":"It's possible to use nested script tags in order to bypass the filtering regex.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-05-11T16:43:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-7691","https://github.com/MrRio/jsPDF/issues/2971","https://github.com/MrRio/jsPDF/commit/d0323215b1a1cd1c35bf2b213274ae1e4797715d","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-575255","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-575253","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-575254","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575252","https://snyk.io/vuln/SNYK-JS-JSPDF-568273","https://github.com/advisories/GHSA-3q6f-8grx-pr4v"],"source_kind":"github","identifiers":["GHSA-3q6f-8grx-pr4v","CVE-2020-7691"],"repository_url":"https://github.com/MrRio/jsPDF","blast_radius":0.0,"created_at":"2022-12-21T16:13:07.888Z","updated_at":"2026-10-12T12:18:35.685Z","epss_percentage":0.01573,"epss_percentile":0.74512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNxNmYtOGdyeC1wcjR2","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNxNmYtOGdyeC1wcjR2","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"2.0.0","vulnerable_version_range":"\u003c 2.0.0"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNxNmYtOGdyeC1wcjR2/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3ZjMtZ2dobS05bWhj","url":"https://github.com/advisories/GHSA-57f3-gghm-9mhc","title":"jspdf vulnerable to Regular Expression Denial of Service (ReDoS)","description":"This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-03-12T21:28:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23353","https://github.com/MrRio/jsPDF/pull/3091","https://github.com/MrRio/jsPDF/commit/d8bb3b39efcd129994f7a3b01b632164144ec43e","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1083289","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1083287","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1083286","https://snyk.io/vuln/SNYK-JS-JSPDF-1073626","https://github.com/advisories/GHSA-57f3-gghm-9mhc"],"source_kind":"github","identifiers":["GHSA-57f3-gghm-9mhc","CVE-2021-23353"],"repository_url":"https://github.com/MrRio/jsPDF","blast_radius":0.0,"created_at":"2022-12-21T16:13:10.982Z","updated_at":"2026-10-12T12:18:30.520Z","epss_percentage":0.02644,"epss_percentile":0.84514,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3ZjMtZ2dobS05bWhj","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3ZjMtZ2dobS05bWhj","packages":[{"ecosystem":"npm","package_name":"jspdf","versions":[{"first_patched_version":"2.3.1","vulnerable_version_range":"\u003c 2.3.1"}],"purl":"pkg:npm/jspdf"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3ZjMtZ2dobS05bWhj/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/jspdf","docker_dependents_count":266,"docker_downloads_count":139884223,"usage_url":"https://repos.ecosyste.ms/usage/npm/jspdf","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/jspdf/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-24T11:32:00.595Z","issues_count":472,"pull_requests_count":281,"avg_time_to_close_issue":13668901.479651162,"avg_time_to_close_pull_request":30563684.410256412,"issues_closed_count":344,"pull_requests_closed_count":234,"pull_request_authors_count":106,"issue_authors_count":447,"avg_comments_per_issue":5.34957627118644,"avg_comments_per_pull_request":0.6619217081850534,"merged_pull_requests_count":45,"bot_issues_count":0,"bot_pull_requests_count":28,"past_year_issues_count":23,"past_year_pull_requests_count":50,"past_year_avg_time_to_close_issue":9958651.6,"past_year_avg_time_to_close_pull_request":6805271.285714285,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":28,"past_year_pull_request_authors_count":22,"past_year_issue_authors_count":22,"past_year_avg_comments_per_issue":1.7391304347826086,"past_year_avg_comments_per_pull_request":0.52,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":26,"past_year_merged_pull_requests_count":2,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/parallax%2FjsPDF/issues","maintainers":[{"login":"HackbrettXXX","count":31,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/HackbrettXXX"},{"login":"MrRio","count":21,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/MrRio"},{"login":"Uzlopak","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Uzlopak"}],"active_maintainers":[{"login":"MrRio","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/MrRio"},{"login":"HackbrettXXX","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/HackbrettXXX"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/jspdf/codemeta","maintainers":[{"uuid":"mrjameshall","login":"mrjameshall","name":null,"email":"james@parall.ax","url":null,"packages_count":4,"html_url":"https://www.npmjs.com/~mrjameshall","role":null,"created_at":"2022-11-10T11:10:32.152Z","updated_at":"2022-11-10T11:10:32.152Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/mrjameshall/packages"}]}