CVE-2026-22787
Medium
Description
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in [email protected].
SeverityMedium
CVSS6.1
Exploit probability—
ProductEkoopmans Html2pdf.js
PublishedJan 14, 2026
First seenJan 14, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- ekoopmans html2pdf.js0.14.0 or later
- html2pdf.js0.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ekoopmans html2pdf.js | v < 0.14.0 | 0.14.0 |
| html2pdf.jsnpm | v < 0.14.0 | 0.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.