Quick Summary
The jsPDF library, used for generating PDF documents in JavaScript applications, has a critical vulnerability tracked as CVE-2025-68428. This flaw allows attackers to exploit local file inclusion and path traversal, enabling them to steal sensitive data from the local filesystem. The vulnerability affects jsPDF versions prior to 4.0 and has a severity score of 9.2, making it a significant risk for the over 3.5 million weekly users of the library.
The Securityish Brief
The jsPDF library, widely used for creating PDF documents in JavaScript applications, is vulnerable to a critical flaw that allows attackers to steal sensitive data from the local filesystem. This vulnerability, identified as CVE-2025-68428, is a local file inclusion and path traversal issue affecting jsPDF versions prior to 4.0. It has a severity score of 9.2, indicating a high level of risk.
The vulnerability arises from the ‘loadFile’ function in jsPDF’s Node.js builds, which can incorporate user-controlled input as file paths. This flaw can lead to the inclusion of sensitive file content in generated PDFs. Other affected file loading methods include ‘addImage’, ‘html’, and ‘addFont’, which can also call the loadFile function.
According to the jsPDF security bulletin, the issue primarily affects the Node.js builds of the library, specifically the dist/jspdf.node.js and dist/jspdf.node.min.js files. The jsPDF team has addressed this vulnerability in version 4.0.0 by restricting filesystem access by default and relying on Node.js permission mode, which is still experimental in Node 20.
Endor Labs has noted that the exploitation risk is low if file paths are hardcoded or come from trusted configurations. However, enabling the ‘–permission’ flag affects the entire Node.js process, and overly broad filesystem permissions can negate the fix. Given jsPDF’s extensive use across numerous projects, CVE-2025-68428 poses a significant risk for active exploitation.
Key Takeaways
- Update jsPDF to version 4.0.0 or later to mitigate the vulnerability.
- Sanitize user-provided paths before passing them to jsPDF to prevent unauthorized access.
- Monitor Node.js configurations to ensure that overly permissive settings are not in use.
- Consider using strict allowlists for file paths to minimize risk.
- Stay informed about updates from the jsPDF team regarding security advisories.
Key Terms & Concepts
- CVE-2025-68428: In this article, CVE-2025-68428 refers to a critical vulnerability in the jsPDF library that allows local file inclusion and path traversal.
- jsPDF: jsPDF is a widely used JavaScript library for generating PDF documents in web applications.
- local file inclusion: Local file inclusion is a type of vulnerability that allows an attacker to include files from the local filesystem in a web application.
- path traversal: Path traversal is a security vulnerability that allows an attacker to access files and directories outside the intended directory.
Read the original article here: https://www.bleepingcomputer.com/news/security/critical-jspdf-flaw-lets-hackers-steal-secrets-via-generated-pdfs/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
