CVE-2026-22787

Print to Pwned: The DOM XSS Inside html2pdf.js

Alon Barad
Alon Barad
Software Engineer

Jan 14, 2026·5 min read·4 visits

Executive Summary (TL;DR)

The html2pdf.js library (versions < 0.14.0) attempted to sanitize HTML input by manually removing <script> tags *after* adding them to the DOM. This 'blacklist' approach failed spectacularly because inline event handlers (like onerror) execute immediately upon parsing. The fix involves implementing DOMPurify to whitelist safe HTML before it ever touches the document.

A high-severity Cross-Site Scripting (XSS) vulnerability in the popular html2pdf.js library allows attackers to execute arbitrary JavaScript by injecting malicious HTML strings during PDF generation.

Fix Analysis (1)

Technical Appendix

CVSS Score
8.7/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected Systems

Web applications using html2pdf.js < 0.14.0Single Page Applications (SPAs) generating client-side reportsInvoice generatorsTicket/Receipt printing services

Affected Versions Detail

Product
Affected Versions
Fixed Version
html2pdf.js
eKoopmans
< 0.14.00.14.0
AttributeDetail
CWE IDCWE-79 (Improper Neutralization of Input During Web Page Generation)
Attack VectorNetwork (Client-Side)
CVSS v4.08.7 (High)
ImpactHigh Confidentiality, High Integrity
Exploit StatusPoC Available / Trivial
Affected Componentsrc/utils.js:createElement
CWE-79
Cross-site Scripting (XSS)

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Vulnerability Timeline

Vulnerability Identified (Issue #865)
2025-11-21
Fix Developed
2026-01-07
Version 0.14.0 Released
2026-01-12
CVE-2026-22787 Published
2026-01-14

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.