SurveyJS v2.5.41
Released: September 3, 2026
This release includes a security fix and other bug fixes. New features are available in the SurveyJS v3.0 major release, which is now officially available.
[Security Vulnerability] Table View: XSS Vulnerability in Question Title Tooltips
SurveyJS Dashboard Table View did not sanitize question titles before displaying them in column header tooltips. An attacker who could supply or modify a survey JSON schema could include malicious JavaScript in a question title. When results for that survey were displayed in Table View, the code could execute when a user hovered over the corresponding table column header.
Exploitation requires the malicious survey schema to be subsequently used to visualize survey data in Dashboard Table View.
This vulnerability is fixed in SurveyJS v2.5.41 and v3.0.3. Question titles are now sanitized before being displayed in tooltips to prevent cross-site scripting (XSS) attacks. Please update to the latest SurveyJS version if you allow users to edit survey JSON schemas in Survey Creator and use those schemas to visualize data in Table View.
Bug Fixes and Minor Enhancements
Form Library
- [Survey Creator] Preview mode: Hide the "Edit" button for pages with no input questions (#11776)
- [Survey Creator] Preview tab enters an infinite render loop for a matrix question when the advanced survey header is enabled (#11778)
- Default progress bar doesn't work with the question-per-page survey layout (#11773)
Survey Creator
onElementGetDisplayNameis not raised in all places whereuseElementTitlesis applied (#7972)
How to Update SurveyJS Libraries in Your Application
Angular
npm i survey-core@v2.5.41 survey-angular-ui@v2.5.41 --save
npm i survey-creator-core@v2.5.41 survey-creator-angular@v2.5.41 --save
npm i survey-analytics@v2.5.41 --save
npm i survey-pdf@v2.5.41 --save
React
npm i survey-core@v2.5.41 survey-react-ui@v2.5.41 --save
npm i survey-creator-core@v2.5.41 survey-creator-react@v2.5.41 --save
npm i survey-analytics@v2.5.41 --save
npm i survey-pdf@v2.5.41 --save
Vue.js
npm i survey-core@v2.5.41 survey-vue3-ui@v2.5.41 --save
npm i survey-creator-core@v2.5.41 survey-creator-vue@2.5.41 --save
npm i survey-analytics@2.5.41 --save
npm i survey-pdf@2.5.41 --save
HTML/CSS/JavaScript
<link href="https://unpkg.com/survey-core@2.5.41/survey-core.min.css" type="text/css" rel="stylesheet">
<script type="text/javascript" src="https://unpkg.com/survey-core@2.5.41/survey.core.min.js"></script>
<script type="text/javascript" src="https://unpkg.com/survey-js-ui@2.5.41/survey-js-ui.min.js"></script>
<script src="https://unpkg.com/survey-core@2.5.41/themes/index.min.js"></script>
<script src="https://unpkg.com/survey-creator-core@2.5.41/themes/index.min.js"></script>
<link href="https://unpkg.com/survey-creator-core@2.5.41/survey-creator-core.min.css" type="text/css" rel="stylesheet">
<script src="https://unpkg.com/survey-creator-core@2.5.41/survey-creator-core.min.js"></script>
<script src="https://unpkg.com/survey-creator-js@2.5.41/survey-creator-js.min.js"></script>
<link href="https://unpkg.com/survey-analytics@2.5.41/survey.analytics.min.css" rel="stylesheet">
<script src="https://unpkg.com/survey-analytics@2.5.41/survey.analytics.min.js"></script>
<script src="https://unpkg.com/survey-pdf@2.5.41/survey.pdf.min.js"></script>
<script src="https://unpkg.com/survey-pdf@2.5.41/pdf-form-filler.min.js"></script>