CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-68428

Summary of CVE-2025-68428 (jsPDF): The Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to 4.0.0 allow local file inclusion/path traversal by passing unsanitized paths to loadFile and certain other methods (addImage, html, addFont). The file contents are embedded verb...

EUVD-2026-0847

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...