jsPDF: Path traversal and local file inclusion (CVE-2025-68428)

CVE-2025-68428 is a critical vulnerability in the jsPDF library (versions < 4.0.0) affecting Node.js implementations. The vulnerability arises when user-controlled input is passed to server-side file-loading functions, enabling path traversal and unauthorized local file inclusion (LFI). Attackers can leverage this to read sensitive files from the server's filesystem.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the affected Node.js application, potentially leading to the disclosure of sensitive configuration files, source code, or credentials.

Recommendation

• Upgrade jsPDF to version 4.0.0 or later immediately.
• Audit server-side code to identify instances where user-supplied input is passed to jsPDF functions like 'loadFile', 'addImage', 'addFont', or 'html()'.
• Implement strict allowlisting for file paths and parameters used in PDF generation endpoints.
• Review Node.js filesystem access permissions and ensure the process runs with the principle of least privilege.
• Use the asset discovery phase to identify where the library is in use across the environment to prioritize patching.