Code Injection and DoS Vulnerabilities in Popular JavaScript/TypeScript Developer Tools

Two widely used JavaScript/TypeScript ecosystem tools disclosed high-severity vulnerabilities that can be triggered by untrusted input during code or document generation. jsPDF patched CVE-2026-24737 (CVSS 8.1), where user-controlled properties in the AcroForm module can enable injection of arbitrary PDF objects (including JavaScript actions) via APIs such as AcroformChoiceField.addOption and AcroFormCheckBox.appearanceState, potentially leading to script execution when a victim opens a crafted PDF. It also patched CVE-2026-24133 (CVSS 8.7), a denial-of-service condition in BMPDecoder reachable through addImage, where a malicious BMP with manipulated width/height headers can force excessive memory allocation and crash the application or browser tab.

Separately, Orval fixed CVE-2026-25141 (CVSS 9.3), a code-injection flaw in its OpenAPI-to-TypeScript client generation pipeline. The issue stems from insufficient sanitization of x-enum-descriptions content embedded into generated block comments; attackers can inject */ to terminate a comment and cause subsequent text to be treated as executable TypeScript/JavaScript. The advisory notes this is a bypass of an earlier fix for CVE-2026-23947, indicating prior mitigations were incomplete; organizations using Orval in CI/CD or consuming third-party OpenAPI specs are at heightened risk if inputs are not strictly trusted and validated.