CVE-2025-68428

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-68428

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68428.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-68428

Aliases

GHSA-f8cm-6447-x5h2

Related

CGA-97rh-5fp4-j59f

Published

2026-01-05T21:43:55.169Z

Modified

2026-03-13T03:49:06.878888Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

jsPDF has Local File Inclusion/Path Traversal vulnerability

Details

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are addImage, html, and addFont. Only the node.js builds of the library are affected, namely the dist/jspdf.node.js and dist/jspdf.node.min.js files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the --permission flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-35",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68428.json"
}

References

Affected packages

Git / github.com/mrrio/jspdf

Affected ranges

Type

GIT

Repo

https://github.com/mrrio/jspdf

Events

Introduced

Fixed

e6cf03db2499ef0a9ccc54b2aba45156c5b32b3c

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.0.0"
        }
    ]
}

Affected versions

1.*

1.1.135

1.3.4

v.*

v.1.4.0

v0.*

v0.9.0

v1.*

v1.0.106

v1.0.115

v1.0.116

v1.0.119

v1.0.138

v1.0.150

v1.0.178

v1.0.272

v1.2.60

v1.2.61

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.4.0

v1.4.1

v1.5.0

v1.5.1

v1.5.2

v1.5.3

Other

v2,1,0

v2.*

v2.0.0

v2.1.1

v2.2.0

v2.3.0

v2.3.1

v2.4.0

v2.5.0

v2.5.1

v2.5.2

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68428.json"

Git / github.com/parallax/jspdf