Node.js jsPDF library < 4.0.0 Local File Inclusion / Path Traversal Vulnerability

The version of jsPDF installed on the remote host is prior to 4.0.0. It is, therefore, affected by a local file inclusion / path traversal vulnerability in its Node.js builds. - The vulnerability exists in the Node.js environment of the library, specifically within the loadFile method and its...

Local File Inclusion (LFI)

jsPDF is vulnerable to a Local File Inclusion. The vulnerability is due to unsanitized user-controlled file paths passed to file-loading methods in the Node.js build, which allows an attacker to read arbitrary local files and include their contents in generated PDF documents...

Exploit for CVE-2025-68428

🚨 jsPDF Bulk Detector – CVE-2025-68428 🚨 Asset-wide detecti...

CVE-2020-7690

All affected versions 2.0.0 of package jspdf are vulnerable to Cross-site Scripting XSS. It is possible to inject JavaScript code via the html method...

PT-2026-1687

A critical Arbitrary File Read vulnerability CVE-2023-50024 has been discovered in the jsPDF library, a popular JavaScript library for client-side PDF generation. Adobe CyberSecNews CyberSecurityAwareness DataSecurity Spyware...

CVE-2025-68428

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

EUVD-2026-0847

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-68428

Summary of CVE-2025-68428 (jsPDF): The Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to 4.0.0 allow local file inclusion/path traversal by passing unsanitized paths to loadFile and certain other methods (addImage, html, addFont). The file contents are embedded verb...

External Control of File Name or Path

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the loadFile, addImage, html and addFont functions. An attacker can access and include arbitrary files from the local file system into generated...

GHSA-F8CM-6447-X5H2 jsPDF has Local File Inclusion/Path Traversal vulnerability

Impact User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node proce...

jsPDF 安全漏洞

jsPDF is Parallax open source a JavaScript-based PDF document generation library . A security vulnerability exists in jsPDF versions prior to 4.0.0, which stems from methods such as loadFile that allow the user to control paths, potentially leading to a local file inclusion or path traversal atta...

PT-2026-1342

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.0.0 Description jsPDF, a JavaScript library for generating PDFs, has a critical flaw in its Node.js builds. Prior to version 4.0.0, the loadFile, addImage, html, and addFont methods are susceptible to local file...

EUVD-2021-0922

Malware in sbrugna...

EUVD-2021-1202

Malware in sbrugna...

EUVD-2021-0607

Malware in sbrugna...

EUVD-2025-6699

Malicious code in bioql PyPI...

CVE-2025-57810

An excessive resource consumption flaw has been discovered in the jsPDF npm library. Passing a maliciously crafted PNG file to the library may result in high CPU usage and a denial of service of the program the library is being used in. Mitigation Mitigation for this issue is either not available...