Critical Vulnerability Patched in jsPDF

A critical vulnerability has been patched in the jsPDF library, which Endor Labs warns could allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials. The flaw, tracked as CVE-2025-68428 with a CVSS of 9.2, is a local file inclusion/path traversal issue in the library’s loadFile method, and arises because user-controlled input can be passed as a file path to read and embed the file contents in generated PDFs.

The vulnerability affects the Node.js builds of jsPDF and was addressed in version 4.0.0, which restricts file access by default. According to Endor Labs, an attacker could exploit this to disclose configuration files, credentials, environment variables and other files accessible to the Node.js process. Public-facing methods such as addImage, html and addFont could be abused as attack vectors. The advisory notes that upgrading to jsPDF 4.0.0 and using Node’s permission flags to limit file access are recommended precautions. 8 January 2026.