A critical code injection vulnerability in the jsPDF library, prior to version 4.2.0, allows unauthenticated attackers to execute malicious actions by injecting arbitrary objects into generated PDFs.

This vulnerability is a code injection flaw (CWE-94) occurring when user-controlled input is passed to the addJS method without proper validation. An unauthenticated attacker can escape the JavaScript string delimiter to manipulate the generated PDF structure, which executes when a victim opens the document.

The ability to inject arbitrary code into generated PDFs poses a significant risk to data integrity and user security. Successful exploitation could lead to unauthorized actions within the context of the user's browser, potentially resulting in session hijacking or the exfiltration of sensitive information. Given the CVSS score of 8.1, this vulnerability is classified as High severity and requires immediate attention to prevent compromise.

Immediate Action: Update the jsPDF library to version 4.2.0 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review application logs for unusual input patterns or unexpected characters being passed to document generation functions, specifically targeting the addJS method.

Compensating Controls: If immediate patching is not feasible, implement strict input sanitization to escape parentheses in all user-provided data before it is passed to the addJS method.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository: https://github.com/absholi7ly/jsPDF-Object-Injection.

The presence of a public proof-of-concept for this injection vulnerability necessitates prompt remediation. Organizations utilizing the jsPDF library to generate dynamic documents must prioritize upgrading to version 4.2.0 to eliminate the injection vector. Failure to update leaves users of your generated PDF content exposed to potential code execution and subsequent security compromises.