CVE-2025-29907
High
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Parall Jspdf
PublishedMar 18, 2025
First seenMar 18, 2025
How to fix
Update
- parall jspdf3.0.1 or later
- jspdf3.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| parall jspdf | v < 3.0.1 | 3.0.1 |
| jspdfnpm | v < 3.0.1 | 3.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.