CVE-2025-68428: Critical Flaw in jsPDF Library Allows Server-Side File Theft

CVE-2025-68428 is a Local File Inclusion and Path Traversal flaw affecting the Node.js builds of jsPDF, which can let an attacker read arbitrary files from the server’s local file system and embed their contents in generated PDFs. The issue lies in how file paths are handled by methods such as loadFile, addImage, html, and addFont, where unsanitised inputs can be passed to dist/jspdf.node.js and dist/jspdf.node.min.js.

The vulnerability has a CVSS score of 9.2 and, according to the advisory, could be triggered by supplying a path to a sensitive local file like ./secret.txt. Maintainers addressed the issue in jsPDF version 4.0.0, introducing a default restriction on file system access.

For those unable to upgrade immediately, the article recommends sanitising user-provided paths for older Node.js versions and, for modern Node.js versions (v20.0.0 and later), using the –permission flag to restrict the process’s file system access at runtime.