CVE-2026-24043
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
描述
### Impact User control of the first argument of the `addMetadata` function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the `addMetadata` method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. Example attack vector: ```js import { jsPDF } from "jspdf" const doc = new jsPDF() // Input a string that closes the current XML tag and opens a new one. // We are injecting a fake "dc:creator" (Author) to spoof the document source. const maliciousInput = '</jspdf:metadata></rdf:Description>' + '<rdf:Description xmlns:dc="http://purl.org/dc/elements/1.1/">' + '<dc:creator>TRUSTED_ADMINISTRATOR</dc:creator>' + // <--- Spoofed Identity '</rdf:Description>' + '<rdf:Description><jspdf:metadata>' // The application innocently adds the user's input to the metadata doc.addMetadata(maliciousInput, "http://valid.namespace") doc.save("test.pdf") ``` ### Patches The vulnerability has been fixed in jsPDF@4.1.0 ### Workarounds Sanitize user input before passing it to the `addMetadata` method: escape XML entities. For example: ```js let input = "..." input = input .replace(/&/g, "&") .replace(/</g, "<") .replace(/>/g, ">") .replace(/"/g, """) .replace(/'/g, "'") doc.addMetadata(input) ```
如何修補 CVE-2026-24043
要修補 CVE-2026-24043,請將受影響套件升級到下列已修補版本。
- —升級至 4.1.0 或更新版本
CVE-2026-24043 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 4.1.0