GHSA-CJW8-79X6-5CJ4

Vulnerability from github – Published: 2026-02-02 18:20 – Updated: 2026-02-03 16:12
VLAI?
Summary
jsPDF has Shared State Race Condition in addJS Plugin
Details

Impact

The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.

If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B.

Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side.

import { jsPDF } from "jspdf";

const docA = new jsPDF();
const docB = new jsPDF();

// 1. User A sets their script (stored in shared 'text' variable)
docA.addJS('console.log("Secret A");');

// 2. User B sets their script (overwrites shared 'text' variable)
docB.addJS('console.log("Secret B");');

// 3. User A saves their PDF (reads current 'text' variable)
docA.save("userA.pdf");

// Result: userA.pdf contains "Secret B" instead of "Secret A"

Patches

The vulnerability has been fixed in jspdf@4.0.1. The fix moves the shared variable into the function scope, ensuring isolation between instances.

Workarounds

Avoid using the addJS method in concurrent server-side environments. If usage is required, ensure requests are processed sequentially (e.g., using a queue) rather than in parallel.

Severity ?
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "jspdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T18:20:02Z",
    "nvd_published_at": "2026-02-02T23:16:07Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.\n\nIf multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B.\n\nTypically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side.\n\n```js\nimport { jsPDF } from \"jspdf\";\n\nconst docA = new jsPDF();\nconst docB = new jsPDF();\n\n// 1. User A sets their script (stored in shared \u0027text\u0027 variable)\ndocA.addJS(\u0027console.log(\"Secret A\");\u0027);\n\n// 2. User B sets their script (overwrites shared \u0027text\u0027 variable)\ndocB.addJS(\u0027console.log(\"Secret B\");\u0027);\n\n// 3. User A saves their PDF (reads current \u0027text\u0027 variable)\ndocA.save(\"userA.pdf\");\n\n// Result: userA.pdf contains \"Secret B\" instead of \"Secret A\"\n```\n\n### Patches\nThe vulnerability has been fixed in jspdf@4.0.1. The fix moves the shared variable into the function scope, ensuring isolation between instances.\n\n### Workarounds\nAvoid using the addJS method in concurrent server-side environments. If usage is required, ensure requests are processed sequentially (e.g., using a queue) rather than in parallel.",
  "id": "GHSA-cjw8-79x6-5cj4",
  "modified": "2026-02-03T16:12:26Z",
  "published": "2026-02-02T18:20:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24040"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/parallax/jsPDF"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parallax/jsPDF/releases/tag/v4.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "jsPDF has Shared State Race Condition in addJS Plugin"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.