chore(deps): update dependency jspdf to v4.2.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jspdf	4.2.0 → 4.2.1

---

jsPDF has a PDF Object Injection via FreeText color

CVE-2026-31898 / GHSA-7x6v-j9x4-qf24

More information

Details

Impact

User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

• createAnnotation: color parameter

Example attack vector:

import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');

Patches

The vulnerability has been fixed in jsPDF@4.2.1.

Workarounds

Sanitize user input before passing it to the vulnerable API members.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/parallax/jsPDF/security/advisories/GHSA-7x6v-j9x4-qf24
• https://github.com/parallax/jsPDF/commit/4155c4819d5eca284168e51e0e1e81126b4f14b8
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-31898
• https://github.com/parallax/jsPDF/blob/b1607a9391d4cd65ea7ade25998aea8345ae1be3/src/modules/annotations.js#L193-L208
• https://github.com/advisories/GHSA-7x6v-j9x4-qf24

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

jsPDF has HTML Injection in New Window paths

CVE-2026-31938 / GHSA-wfv2-pwc8-crg5

More information

Details

Impact

User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

• "pdfobjectnewwindow": the pdfObjectUrl option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
• "pdfjsnewwindow": the pdfJsUrl and filename options
• "dataurlnewwindow": the filename option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});

Patches

The vulnerability has been fixed in jspdf@4.2.1.

Workarounds

Sanitize user input before passing it to the output method.

Severity

• CVSS Score: 9.6 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

• https://github.com/parallax/jsPDF/security/advisories/GHSA-wfv2-pwc8-crg5
• https://github.com/parallax/jsPDF/commit/87a40bbd07e6b30575196370670b41f264aa78d7
• https://github.com/parallax/jsPDF/releases/tag/v4.2.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-31938
• https://github.com/advisories/GHSA-wfv2-pwc8-crg5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

parallax/jsPDF (jspdf)

v4.2.1

Compare Source

This release fixes two security issues.

What's Changed

• Fix HTML Injection in output methods vulnerability.
• Fix PDF Object Injection via free text annotation color vulnerability.

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 33.18%. Comparing base (b1b7796) to head (efaf6ba).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #95   +/-   ##
=======================================
  Coverage   33.18%   33.18%           
=======================================
  Files          92       92           
  Lines       16746    16746           
  Branches     5454     5382   -72     
=======================================
  Hits         5557     5557           
  Misses      11189    11189           

Flag	Coverage Δ
e2e	33.18% <ø> (ø)
integration-openaev	33.18% <ø> (ø)
integration-opencti	33.18% <ø> (ø)
unittests	33.18% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.