CVE-2026-24737

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, and AcroFormRadioButton.appearanceState. The vulnerability has been fixed in jsPDF@4.1.0.

• CWE-116
• CWE-917

• https://github.com/parallax/jsPDF/commit/da291a5f01b96282545c9391996702cdb8879f79Patch
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0Release Notes
• https://github.com/parallax/jsPDF/security/advisories/GHSA-pqxr-3g65-p328Exploit, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:4466
• https://access.redhat.com/errata/RHSA-2026:4467
• https://access.redhat.com/security/cve/CVE-2026-24737
• https://bugzilla.redhat.com/show_bug.cgi?id=2436115
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24737.json

Published

Feb 2, 2026

Last Modified

Jul 20, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24731WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-24732Files or Directories Accessible to External Parties, Incorre…6.6
• CVE-2026-24733Improper Input Validation vulnerability in Apache Tomcat. …3.7
• CVE-2026-24734Improper Input Validation vulnerability in Apache Tomcat Nat…7.5
• CVE-2026-24735Exposure of Private Personal Information to an Unauthorized …7.5
• CVE-2026-24736Squidex is an open source headless content management system…8.8
• CVE-2026-24738gmrtd is a Go library for reading Machine Readable Travel Do…6.5
• CVE-2026-24739Symfony is a PHP framework for web and console applications …6.3
• CVE-2026-2474Crypt::URandom versions from 0.41 before 0.55 for Perl is vu…7.5
• CVE-2026-24740Dozzle is a realtime log viewer for docker containers. Prior…9.9
• CVE-2026-24741ConvertXis a self-hosted online file converter. In versions …8.1
• CVE-2026-24742Discourse is an open source discussion platform. In versions…6.5