jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.

Affected: npm: jspdf

### Impact

User control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

* `createAnnotation`: `color` parameter

Example attack vector:

```js import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({ type: 'freetext', bounds: { x: 10, y: 10, w: 120, h: 20 }, contents: 'hello', color: payload });

doc.save('test.pdf'); ```

### Patches

The vulnerability has been fixed in jsPDF@4.2.1.

### Workarounds Sanitize user input before passing it to the vulnerable API members.

fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug jsPDF: denial of service via malicious GIF dimensions jsPDF: PDF object injection via unsanitized input in addJS method fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling jsPDF: PDF injection in AcroForm module allows arbitrary JavaScript execution (RadioButton children) fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service svgo: SVGO: Denial of Service via XML entity expansion jspdf: jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method jspdf: jsPDF: Cross site scripting via unsanitized output options fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.