NewAI Enhanced
v4.1.0
Security Fixes
Breaking Changes:
- dompurify optional dependency upgraded to 3.3.1
Fixes:
- PDF Injection in AcroForm module — arbitrary JavaScript execution via form fields
- XMP Metadata Injection — stored metadata spoofing and integrity violations
- Race condition in
addJS()method with shared state - DoS via unvalidated BMP image dimensions in BMPDecoder
This release fixes several security issues.
What's Changed
- Upgrade optional dompurify dependency to 3.3.1 in https://github.com/parallax/jsPDF/pull/3948
- Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution vulnerability
- Fix Stored XMP Metadata Injection (Spoofing & Integrity Violation) vulnerability
- Fix Shared State Race Condition in addJS Method vulnerability
- Fix Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder vulnerability
Full Changelog: https://github.com/parallax/jsPDF/compare/v4.0.0...v4.1.0