surveyjs/survey-pdf · Security
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
- GHSA ID
- GHSA-h3q6-jfrg-3x6q
- CVE ID
- CVE-2026-25630
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Description
The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.
Impact
Since SurveyJS PDF Generator depends on jsPDF, any project using survey-pdf v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability.
Solution
SurveyJS PDF Generator has upgraded jsPDF to version >= 4.0.0 and included the fix in the following survey-pdf releases:
Action
Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately.
Notes
No other survey-pdf dependencies are affected. This update is fully backward-compatible with previous survey-pdf releases.
CWEs
- CWE-35 · Path Traversal: '.../...//'
- CWE-73 · External Control of File Name or Path