CVE-2026-114491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114491
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114491.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114491
Published
2026-10-21T17:54:16Z
Modified
2026-10-22T02:48:52Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
Details

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114491.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "0.3.8"
                        },
                        {
                            "fixed":  "0.3.12"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "0.3.8"
                        },
                        {
                            "fixed":  "0.3.12"
                        }
                    ],
                    "source":  "CPE_FIELD",
                    "strategy":  "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "0.3.8"
                        },
                        {
                            "fixed":  "0.3.12"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/bpampuch/pdfmake

Affected ranges

Type
GIT
Repo
https://github.com/bpampuch/pdfmake
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
Fixed
9c634c52e994faafb5dde11b719e804deedeaf98
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "4ad4cbf2713568304dd4cbc3090bfb912a78dfdd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "0.3.12",
            "range":  [
                {
                    "fixed":  "9c634c52e994faafb5dde11b719e804deedeaf98"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.0.10
0.0.11
0.0.12
0.0.13
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.15
0.1.17
0.1.18
0.1.2
0.1.20
0.1.22
0.1.23
0.1.24
0.1.25
0.1.26
0.1.27
0.1.28
0.1.29
0.1.3
0.1.30
0.1.31
0.1.32
0.1.33
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.40
0.1.6
0.1.7
0.1.8
0.3.0
0.3.0-beta.1
0.3.0-beta.10
0.3.0-beta.11
0.3.0-beta.12
0.3.0-beta.13
0.3.0-beta.14
0.3.0-beta.15
0.3.0-beta.16
0.3.0-beta.17
0.3.0-beta.18
0.3.0-beta.19
0.3.0-beta.2
0.3.0-beta.3
0.3.0-beta.4
0.3.0-beta.5
0.3.0-beta.6
0.3.0-beta.7
0.3.0-beta.8
0.3.0-beta.9
0.3.1
0.3.10
0.3.11
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114491.json"