Cross-site scripting in jspdf

中危 6.1CVE-2020-7690 · GHSA-vh59-v9r5-4mh4 · SNYK-JS-JSPDF-575256 · Published 06/07/2020 · updated 17/06/2026

要点

CVE-2020-7690 是影响 jspdf (parall), jspdf 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.97%，高于 61.9% 的漏洞。
修复：升级到 2.0.0 或更高版本。

Package	Affected versions	Patched versions
jspdf parall	`< 2.0.0`	`2.0.0`
jspdf npm	`< 2.0.0`	`2.0.0`

Description

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to inject JavaScript code via the html method.

NVD description

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

References

nvd.nist.gov/vuln/detail/CVE-2020-7690 · ADVISORY
MrRio/jsPDF · WEB
parallax/jsPDF · WEB
parallax/jsPDF · WEB
parallax/jsPDF#2806 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-575260 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-575258 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-575259 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575257 · WEB
snyk.io/vuln/SNYK-JS-JSPDF-575256 · WEB

jspdf 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jspdf

parall

< 2.0.0

2.0.0

jspdf

npm

< 2.0.0

2.0.0

Description

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to inject JavaScript code via the html method.

NVD description

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.

jspdf 的其他漏洞

查看全部 →