CVE-2026-31898
Fixed in a distro release EPSS <1%CVSS 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
Products: parallax jsPDF, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | jspdf | 4.2.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 2.19.5-r2 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.5.0-r9 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.5.0-r9 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r9 |