CVE-2026-22787
Last modified
CVE-2026-22787 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in html2pdf.js@0.14.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ekoopmans | Html2pdf.Js | < 0.14.0 |
References
- https://github.com/eKoopmans/html2pdf.js/issues/865Issue Tracking
- https://github.com/eKoopmans/html2pdf.js/pull/877Issue Tracking, Patch
- https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fcPatch, Vendor Advisory
- https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability/Exploit, Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-22787?
How severe is CVE-2026-22787?
How do I fix CVE-2026-22787?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22781TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.8
- CVE-2026-22782RustFS is a distributed object storage system built in Rust.…7.5
- CVE-2026-22783Iris is a web collaborative platform that helps incident res…8.1
- CVE-2026-22784Lychee is a free, open-source photo-management tool. Prior t…4.3
- CVE-2026-22785orval generates type-safe JS clients (TypeScript) from any v…9.8
- CVE-2026-22786Gin-vue-admin is a backstage management system based on vue …7.2
- CVE-2026-22788WebErpMesv2 is a Resource Management and Manufacturing execu…8.2
- CVE-2026-22789WebErpMesv2 is a Resource Management and Manufacturing execu…8.8
- CVE-2026-2279The myLinksDump plugin for WordPress is vulnerable to SQL In…7.2
- CVE-2026-22790EVerest is an EV charging software stack. Prior to version 2…8.8
- CVE-2026-22791openCryptoki is a PKCS#11 library and tools for Linux and AI…6.1
- CVE-2026-227925ire is a cross-platform desktop artificial intelligence ass…9.6
Are you affected by CVE-2026-22787?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST