IBM Support

IT49583: SI APAR:CVE-2025-68428,CVE-2026-(24040,24043,24133,24737,25535,25755,25940)

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • CVEs: (details as of the time of ADV creation)
    CVEID: CVE-2025-68428
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to version 4.0.0, user control of the first argument of
    the loadFile method in the node.js build allows local file
    inclusion/path traversal. If given the possibility to pass
    unsanitized paths to the loadFile method, a user can retrieve
    file contents of arbitrary files in the local file system the
    node process is running in. The file contents are included
    verbatim in the generated PDFs. Other affected methods are
    `addImage`, `html`, and `addFont`. Only the node.js builds of
    the library are affected, namely the `dist/jspdf.node.js` and
    `dist/jspdf.node.min.js` files. The vulnerability has been fixed
    in jsPDF@4.0.0. This version restricts file system access per
    default. This semver-major update does not introduce other
    breaking changes. Some workarounds areavailable. With recent
    node versions, jsPDF recommends using the `--permission` flag in
    production. The feature was introduced experimentally in v20.0.0
    and is stable since v22.13.0/v23.5.0/v24.0.0. For older node
    versions, sanitize user-provided paths before passing them to
    jsPDF.
    CWE: CWE-35: Path Traversal: '.../...//'
    CVSS Source: NVD
    CVSS Base Score: 7.5
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
    
    CVEID: CVE-2026-24040
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.1.0, the addJS method in the jspdf Node.js build
    utilizes a shared module-scoped variable (text) to store
    JavaScript content. When used in a concurrent environment (e.g.,
    a Node.js web server), this variable is shared across all
    requests. If multiple requests generate PDFs simultaneously, the
    JavaScript content intended for one user may be overwritten by a
    subsequent request before the document is generated. This
    results in Cross-User Data Leakage, where the PDF generated for
    User A contains the JavaScript payload (and any embedded
    sensitive data) intended for User B. Typically, this only
    affects server-side environments, although the same race
    conditions might occur if jsPDF runs client-side. The
    vulnerability has been fixed in jsPDF@4.1.0.
    CWE: CWE-362: Concurrent Execution using Shared Resource with
    Improper Synchronization ('Race Condition')
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 6.3
    CVSS Vector:
    (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
    /E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MV
    A:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
    
    CVEID: CVE-2026-24043
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.1.0, user control of the first argument of the
    addMetadata function allows users to inject arbitrary XML. If
    given the possibility to pass unsanitized input to the
    addMetadata method, a user can inject arbitrary XMP metadata
    into the generated PDF. If the generated PDF is signed, stored
    or otherwise processed after, the integrity of the PDF can no
    longer be guaranteed. The vulnerability has been fixed in
    jsPDF@4.1.0.
    CWE: CWE-74: Improper Neutralization of Special Elements in
    Output Used by a Downstream Component ('Injection')
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 6.9
    CVSS Vector:
    (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
    /E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MV
    A:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
    
    CVEID: CVE-2026-24133
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.1.0, user control of the first argument of the
    addImage method results in denial of service. If given the
    possibility to pass unsanitized image data or URLs to the
    addImage method, a user can provide a harmful BMP file that
    results in out of memory errors and denial of service. Harmful
    BMP files have large width and/or height entries in their
    headers, which lead to excessive memory allocation. The html
    method is also affected. The vulnerability has been fixed in
    jsPDF@4.1.0.
    CWE: CWE-770: Allocation of Resources Without Limits or
    Throttling
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 8.7
    CVSS Vector:
    (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    /E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MV
    A:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
    
    CVEID: CVE-2026-24737
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.1.0, user control of properties and methods of the
    Acroform module allows users to inject arbitrary PDF objects,
    such as JavaScript actions. If given the possibility to pass
    unsanitized input to one of the following methods or properties,
    a user can inject arbitrary PDF objects, such as JavaScript
    actions, which are executed when the victim opens the document.
    The vulnerable API members are AcroformChoiceField.addOption,
    AcroformChoiceField.setOptions,
    AcroFormCheckBox.appearanceState, and
    AcroFormRadioButton.appearanceState. The vulnerability has been
    fixed in jsPDF@4.1.0.
    CWE: CWE-116: Improper Encoding or Escaping of Output
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 8.1
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
    
    CVEID: CVE-2026-25535
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.2.0, user control of the first argument of the
    `addImage` method results in denial of service. If given the
    possibility to pass unsanitized image data or URLs to the
    `addImage` method, a user can provide a harmful GIF file that
    results in out of memory errors and denial of service. Harmful
    GIF files have large width and/or height entries in their
    headers, which lead to excessive memory allocation. Other
    affected methods are: `html`. The vulnerability has been fixed
    in jsPDF 4.2.0. As a workaround, sanitize image data or URLs
    before passing it to the addImage method or one of the other
    affected methods.
    CWE: CWE-400: Uncontrolled Resource Consumption
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 8.7
    CVSS Vector:
    (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    /E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MV
    A:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
    
    CVEID: CVE-2026-25755
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.2.0, user control of the argument of the `addJS`
    method allows an attacker to inject arbitrary PDF objects into
    the generated document. By crafting a payload that escapes the
    JavaScript string delimiter, an attacker can execute malicious
    actions or alter the document structure, impacting any user who
    opens the generated PDF. The vulnerability has been fixed in
    jspdf@4.2.0. As a workaround, escape parentheses in
    user-provided JavaScript code before passing them to the `addJS`
    method.
    CWE: CWE-94: Improper Control of Generation of Code ('Code
    Injection')
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 8.1
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
    
    CVEID: CVE-2026-25940
    Description: jsPDF is a library to generate PDFs in JavaScript.
    Prior to 4.2.0, user control of properties and methods of the
    Acroform module allows users to inject arbitrary PDF objects,
    such as JavaScript actions. If given the possibility to pass
    unsanitized input to one of the following property, a user can
    inject arbitrary PDF objects, such as JavaScript actions, which
    are executed when the victim hovers over the radio option. The
    vulnerability has been fixed in jsPDF@4.2.0. As a workaround,
    sanitize user input before passing it to the vulnerable API
    members.
    CWE: CWE-116: Improper Encoding or Escaping of Output
    CVSS Source: security-advisories@github.com
    CVSS Base Score: 8.1
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * IBM Storage Insights users                                   *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * SECURITY APAR FOR:                                           *
    * CVE-2025-68428,CVE-2026-24040,CVE-2026-24043,                *
    * CVE-2026-24133,CVE-2026-24737,CVE-2026-25535,                *
    * CVE-2026-25755,CVE-2026-25940                                *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    

Problem conclusion

  • The fix for this APAR is contained in the following release:
    
    IBM Storage Insights 2Q26   [ 54X-IBM-SI ]
    ( release target 2Q 2026 / June )
    
    To protect IBM Storage Insights against emerging
    security vulnerabilities, the service was updated to
    protected against vulnerabilities.
    
    No action is required, there is nothing that you need
    to do following the IBM Storage Insights upgrade.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT49583

  • Reported component name

    STORAGE INSIGHT

  • Reported component ID

    5608TPCSI

  • Reported release

    54X

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2026-06-18

  • Closed date

    2026-06-18

  • Last modified date

    2026-06-18

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    STORAGE INSIGHT

  • Fixed component ID

    5608TPCSI

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSQRB8","label":"IBM Storage Insights"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"54X","Line of Business":{"code":"LOB69","label":"Storage TPS"}}]

Document Information

Modified date:
18 June 2026