Description
jsPDF, a JavaScript library for generating PDFs, contains a critical flaw in its Node.js builds. Prior to version 4.0.0, the
loadFile
,
addImage
,
html
, and
addFont
methods are susceptible to local file inclusion and path traversal. This allows an attacker to retrieve the contents of arbitrary files from the system where the Node.js process is running, embedding them directly into the generated PDF. The
loadFile
method is particularly vulnerable due to the potential for passing unsanitized paths. This issue affects the
dist/jspdf.node.js
and
dist/jspdf.node.min.js
files. Exploitation of this flaw can lead to the theft of sensitive information, such as configuration files and credentials. There have been reports of exploitation in the wild, with attackers actively leveraging this vulnerability to extract data from enterprise servers. The vulnerability is tracked as CVE-2025-68428 and has a severity score of 9.2.
Recommendations
Upgrade to jsPDF version 4.0.0 or later.
For older Node.js versions, sanitize user-provided paths before passing them to jsPDF.
With recent Node.js versions (22.13.0/23.5.0/24.0.0 and later), consider using the
--permission
flag in production to restrict file system access.