CVE-2025-57810: parall jspdf Improper Input Validation
CVSS: 8.7v4.0HighAnalyzed
AliasesCGA-9gp4-gj3v-xm4xCGA-mpvf-gqvh-qc5vGHSA-8mvj-3j78-4qmwCGA-2vvw-pgfc-8x4xCGA-2wjf-xgfv-vq9qCGA-3jvq-rm55-7fghCGA-3rm4-8666-f69rCGA-3v78-8vpx-22whCGA-4p65-2jr9-vjcpCGA-4vw3-x476-73crCGA-54fg-j996-5jg6CGA-5jr2-2h24-xvccCGA-5wvh-3h78-42xvCGA-654c-6j7g-526wCGA-65rc-xpcw-jc6vCGA-6p5r-m3rf-qfc8CGA-6p6q-4pwv-5r86CGA-6q52-2xm4-5qhrCGA-6v3p-w295-7p8rCGA-6xf2-f9hg-f2g5CGA-82g2-3gg6-rr35CGA-847q-h78x-8mvqCGA-85j8-vg5p-6349CGA-868f-5mx3-v98hCGA-86h9-2fvw-3x3wCGA-8wvq-qr4m-wghwCGA-9jv8-5gfm-8xhjCGA-c9c5-2v3r-52wfCGA-cj2h-wcp2-92xrCGA-cvmc-8hfv-3jjgCGA-f3g4-mq73-6xg5CGA-g6w7-wcvx-7vcxCGA-gmff-m394-p93qCGA-gqgv-q37g-32h9CGA-gw59-p99x-6fj4CGA-h74g-p5ww-9cg4CGA-hhxm-fpww-w7fpCGA-jg74-2rcq-9vvxCGA-jr5c-cq26-f2jjCGA-m9jq-24hw-qx43CGA-mjr8-gqx7-q492CGA-mm6h-qq9g-6858CGA-mpf8-mx28-vvh9CGA-mx8x-q6xv-mj4cCGA-mxg4-9r38-h89pCGA-p777-c435-5hc2CGA-q2gj-m4wc-43rcCGA-qfgq-m78m-9ccpCGA-r3jf-hf2q-jvgrCGA-rg5m-9w3f-5p4pCGA-rmfg-c92w-wvqhCGA-vjgp-4vxq-6hq8CGA-vpf3-wgxh-9hvrCGA-w8c2-cv68-gvxjCGA-wg27-j452-c2rpCGA-x39h-c79m-7r5cCGA-x9v2-39cw-gv3mCGA-xh85-f4vp-7768
Published 26-08-2025Last modified 26-08-2025
Vulnerability summary
CVE-2025-57810 is a high (CVSS 8.7) Improper Input Validation vulnerability in parall jspdf. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.70%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 26-08-2025PublishedVulnerability first disclosed.
- 26-08-2025Last modifiedVulnerability information updated.
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.
CVSS metrics
7 scores · 5 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
-0.01 pp
From 0.71% on 19-09-2026
19-09-202619-10-2026
EPSS score0.70%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundJspdf
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard29 products
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.3-r0 | < 2.19.4-r0
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.3-r0 | < 2.19.4-r0
- opensearch-dashboards-2-dashboards-maps< 2.19.4-r0 | < 2.19.3-r0
- opensearch-dashboards-2-dashboards-notifications< 2.19.3-r0
- opensearch-dashboards-2-dashboards-observability< 2.19.3-r0
Npm1 product
- jspdf< 3.0.2
Parall1 product
- jspdf< 3.0.2
Parallax1 product
- jspdf< 3.0.2
Wolfi1 product
- opensearch-dashboards-3-dashboards-reporting< 3.4.0-r0
5 vendors · 33 products
References
7 links- github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmwX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9X Refsource MISCFIXWEBPatch
- github.com/parallax/jsPDFPACKAGE