A serious flaw in the jsPDF module for creating PDF documents in JavaScript programs enables an attacker to steal private information from the local disk by including it into created files.
In jsPDF versions prior to 4.0, the weakness is a local file inclusion and path traversal that permits sending unsanitized paths to the file loading mechanism (loadFile). It has a severity score of 9.2 and is tracked as CVE-2025-68428.
With over 3.5 million weekly downloads in the npm registry, the jsPDF library is a popular package.
The local filesystem is read using the ‘loadFile’ function in jsPDF’s Node.js builds. The issue is that when user-controlled input is supplied as the file path, jsPDF incorporates the file’s content into the resulting PDF output.
Since they can all call the loadFile function, other file loading techniques like read more about Critical jsPDF flaw lets hackers steal secrets via generated PDFs.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.