{"action":"Upgrade html2pdf.js to 0.14.0 or later.","affected":[{"fixed":"0.14.0","introduced":"0"}],"component":"html2pdf.js","cve_ids":["CVE-2026-22787"],"ecosystem":"npm","epss":0.0039,"exploited":false,"fixed_versions":["0.14.0"],"ghsa_id":"GHSA-w8x4-x68c-m6fc","id":"tcs_01M5KGEJ6F4RZHJHMZBJFMDDX2","modified_at":"2026-02-03T03:11:31.431997Z","published_at":"2026-01-14T16:53:10Z","references":["https://osv.dev/vulnerability/GHSA-w8x4-x68c-m6fc","https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc","https://nvd.nist.gov/vuln/detail/CVE-2026-22787","https://github.com/eKoopmans/html2pdf.js/issues/865","https://github.com/eKoopmans/html2pdf.js/pull/877","https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b","https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability","https://github.com/eKoopmans/html2pdf.js","https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-w8x4-x68c-m6fc","url":"https://osv.dev/vulnerability/GHSA-w8x4-x68c-m6fc"},{"source":"nvd","source_id":"CVE-2026-22787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22787"}],"summary":"html2pdf.js contains a cross-site scripting vulnerability"}