Detections
Analytics

SCA: security update for jspdf (GHSA-wfv2-pwc8-crg5)

medium Tenable Cloud Security Plugin ID 438883

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options`
 argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the
 browser context the created PDF is opened in. The vulnerability can be exploited in the following
 scenario: the attacker provides values for the output options, for example via a web interface. These
 values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim
 creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their
 browser. The attacker can thus inject scripts that run in the victims browser context and can extract or
 modify secrets from this context. The vulnerability has been fixed in [email protected]. As a workaround,
 sanitize user input before passing it to the output method. (CVE-2026-31938)

Solution

Update the jspdf library and its related packages to version 4.2.1 or later.

See Also

https://github.com/advisories/GHSA-wfv2-pwc8-crg5

Plugin Details

Severity: Medium

ID: 438883

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/17/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.63

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-31938

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/17/2026

Vulnerability Publication Date: 3/17/2026

Reference Information

CVE: CVE-2026-31938

cwe: CWE-79