Description

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

Remediation

References

https://github.com/MrRio/jsPDF/issues/2795

https://snyk.io/vuln/SNYK-JS-JSPDF-575256

Related Vulnerabilities

CVE-2020-7755 Vulnerability in npm package dat.gui

CVE-2020-7721 Vulnerability in npm package node-oojs

CVE-2023-29524 Vulnerability in maven package org.xwiki.platform:xwiki-platform-scheduler-ui

CVE-2023-26056 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-macro-context

CVE-2017-16208 Vulnerability in npm package dmmcquay.lab6

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory