{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ajspdfjspdfnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jspdf:jspdf:*:*:*:*:*:node.js:*:*","cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2025-68428"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jsPDF (\u003c 4.0.0)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","local-file-inclusion","nodejs","vulnerability","cve-2025-68428"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2025-68428 is a critical vulnerability in the jsPDF library (versions \u0026lt; 4.0.0) affecting Node.js implementations. The vulnerability arises when user-controlled input is passed to server-side file-loading functions, enabling path traversal and unauthorized local file inclusion (LFI). Attackers can leverage this to read sensitive files from the server's filesystem.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the affected Node.js application, potentially leading to the disclosure of sensitive configuration files, source code, or credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade jsPDF to version 4.0.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit server-side code to identify instances where user-supplied input is passed to jsPDF functions like 'loadFile', 'addImage', 'addFont', or 'html()'.\u003c/li\u003e\n\u003cli\u003eImplement strict allowlisting for file paths and parameters used in PDF generation endpoints.\u003c/li\u003e\n\u003cli\u003eReview Node.js filesystem access permissions and ensure the process runs with the principle of least privilege.\u003c/li\u003e\n\u003cli\u003eUse the asset discovery phase to identify where the library is in use across the environment to prioritize patching.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T18:59:31Z","date_published":"2026-10-30T18:59:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jspdf-lfi/","summary":"A critical path traversal and local file inclusion vulnerability in jsPDF versions prior to 4.0.0 allows unauthenticated attackers to read arbitrary files in Node.js server-side environments.","title":"jsPDF: Path traversal and local file inclusion (CVE-2025-68428)","url":"https://feed.craftedsignal.io/briefs/2026-10-jspdf-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:jspdf:jspdf:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}