Security readout for executives and security teams
Plain-English summary
CVE-2026-22787 affects html2pdf.js, a client-side library used to turn web content into PDFs. Versions before 0.14.0 can mishandle text input and place unsafe content into the browser page, allowing cross-site scripting. Impact depends on where the library is used and whether attacker-controlled text can reach PDF generation.
Executive priority
Treat as a high-priority frontend dependency update for applications that generate PDFs from user-controlled content. Prioritize internet-facing portals, customer document workflows, and administrative tools where browser session data is sensitive.
Technical view
html2pdf.js before 0.14.0 has a CWE-79 XSS issue when given a text source instead of an element. The text is insufficiently sanitized before DOM attachment, enabling script execution in the client browser. The CVSS 4.0 score is 8.7 with network attack vector, low complexity, no privileges, and user interaction required.
Likely exposure
Applications are most exposed if they use html2pdf.js versions below 0.14.0 and pass user-supplied or untrusted text into the library for PDF generation. Exposure may be indirect through bundled frontend dependencies or copied vendor scripts.
Exploitation context
The sources do not indicate known active exploitation, and this CVE is not marked KEV. Exploitation requires a user interaction path where malicious text is processed by vulnerable html2pdf.js in a browser context. Successful abuse could affect page data confidentiality and integrity.
Researcher notes
Evidence identifies the vulnerable condition, affected versions, CVSS vector, fix version, GitHub advisory, issue, pull request, commit, and release. Public sources provided here do not establish exploitation in the wild. Validate exposure by tracing whether text input reaches html2pdf.js before DOM insertion.
Mitigation direction
- Upgrade html2pdf.js to version 0.14.0 or later.
- Review vendor advisory and release notes before deployment.
- Identify bundled or vendored copies of html2pdf.js in frontend assets.
- Avoid passing untrusted text to vulnerable versions until upgraded.
- Apply normal XSS defenses where html2pdf.js output touches the DOM.
Validation and detection
- Inventory package manifests and lockfiles for html2pdf.js versions below 0.14.0.
- Search built frontend assets for bundled html2pdf.js copies.
- Review PDF generation code paths for text-source usage.
- Confirm deployed applications load the upgraded library version.
- Check dependency scanners for CVE-2026-22787 or GHSA-w8x4-x68c-m6fc.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22787 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fcCVE reference · x_refsource_CONFIRM
- https://github.com/eKoopmans/html2pdf.js/issues/865CVE reference · x_refsource_MISC
- https://github.com/eKoopmans/html2pdf.js/pull/877CVE reference · x_refsource_MISC
- https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7bCVE reference · x_refsource_MISC
- https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0CVE reference · x_refsource_MISC
- https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.