Critical jsPDF Flaw Allows Attackers to Steal Secrets Through Maliciously Generated PDFs

A critical security vulnerability has been disclosed in jsPDF, a widely used JavaScript library for generating PDF documents in web applications. The flaw allows attackers to craft malicious PDF files capable of leaking sensitive information, including authentication tokens and confidential application data, directly from the environments where the PDFs are generated.

The issue affects applications that rely on jsPDF to dynamically create documents on the client side, a common pattern in dashboards, invoicing systems, and internal reporting tools.

What went wrong in jsPDF

The vulnerability stems from unsafe handling of user-controlled input during the PDF generation process. Researchers found that specially crafted content embedded into a PDF could trigger unintended behaviour when the document is rendered or processed, allowing access to data that should never be exposed.

Because jsPDF often runs in trusted application contexts, any leakage occurs with the same privileges as the application itself.

Why generated PDFs became an attack vector

PDF files are typically treated as inert output. In many applications, once data is written into a PDF, developers assume it cannot influence application logic.

The flaw in jsPDF breaks that assumption. Attackers can inject content that abuses the PDF structure to reference or expose secrets that were present during generation, including session tokens, API keys, or internal identifiers.

Attack scenarios and real-world risk

In a typical attack scenario, an application allows users to submit data that is later included in a generated PDF, such as a report, receipt, or export file. By manipulating that input, an attacker can generate a PDF that silently embeds sensitive values.

The stolen data may only become visible when the PDF is opened, shared, or inspected, making detection difficult and often delayed.

What kind of data can be exposed

Security researchers warn that the impact depends on how jsPDF is used within an application. In vulnerable implementations, exposed data can include authentication tokens, user identifiers, internal URLs, and application secrets available in memory at generation time.

In single-page applications, where client-side state often contains sensitive information, the risk is significantly higher.

Scale of exposure

jsPDF is downloaded millions of times per month and is embedded in countless production applications, from small internal tools to large enterprise platforms.

Any application that generates PDFs from partially user-controlled content without strict sanitisation may be affected, particularly older deployments that have not been updated recently.

Why this bug is hard to spot

The vulnerability does not rely on traditional code execution or crashes. Instead, it abuses document generation logic, meaning security testing that focuses only on server-side APIs or network traffic may miss it entirely.

Many organisations do not treat generated documents as a potential security boundary, leaving blind spots in threat models.

Mitigation and patching guidance

Developers are strongly advised to update jsPDF to the latest patched version immediately. Where updates are not possible, applications should strictly sanitise all user-supplied input before it is passed into PDF generation routines.

Security teams should also review whether sensitive secrets are unnecessarily present in client-side contexts during document generation.

Broader implications for frontend security

The jsPDF flaw highlights a wider issue in modern web development: client-side libraries often operate with access to sensitive state, yet are not always subjected to the same scrutiny as backend components.

As more logic moves into browsers, document generation, rendering engines, and export features are becoming attractive targets for attackers.

What security teams should do next

Organisations should inventory applications that generate PDFs on the client side and assess how user input flows into those documents. Code reviews and security testing should explicitly include document generation paths.

Where possible, sensitive secrets should be removed from client-side memory before PDF creation, reducing the blast radius of similar flaws in the future.