jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.

zetlyn/cve-nvd vulnerability cve CVE-2025-68428 cpe cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:* known 2026-01-05

https://nvd.nist.gov/vuln/detail/CVE-2025-68428

Properties

cvss	7.5 receipt Source NVD Its words `7.5` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "jsPDF", "vendor": "parallax", "versions": [ { "status": "affected", "version": "< 4.0.0" } ] } ], "source": "security-advisories@github.com" }, { "affectedData": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.8::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1769615659", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.9::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1770074713", "versionType": "rpm" }, { "lessThan": "", "status": "unaffected", "version": "1770250889", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-rhel8-operator", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:parall:jspdf::::::node.js::", "matchCriteriaId": "1EED4B66-0CA7-43D9-A73B-505062F90B4D", "versionEndExcluding": "4.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF." }, { "lang": "es", "value": "jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versión 4.0.0, el control del usuario sobre el primer argumento del método loadFile en la compilación de node.js permite la inclusión local de ficheros/salto de ruta. Si se le da la posibilidad de pasar rutas no saneadas al método loadFile, un usuario puede recuperar el contenido de ficheros arbitrarios en el sistema de ficheros local en el que se está ejecutando el proceso de node. El contenido de los ficheros se incluye textualmente en los PDFs generados. Otros métodos afectados son 'addImage', 'html' y 'addFont'. Solo las compilaciones de node.js de la biblioteca están afectadas, concretamente los ficheros 'dist/jspdf.node.js' y 'dist/jspdf.node.min.js'. La vulnerabilidad ha sido corregida en jsPDF@4.0.0. Esta versión restringe el acceso al sistema de ficheros por defecto. Esta actualización semver-major no introduce otros cambios disruptivos. Algunas soluciones alternativas están disponibles. Con las versiones recientes de node, jsPDF recomienda usar la bandera '--permission' en producción. La característica fue introducida experimentalmente en v20.0.0 y es estable desde v22.13.0/v23.5.0/v24.0.0. Para versiones de node más antiguas, sanee las rutas proporcionadas por el usuario antes de pasarlas a jsPDF." } ], "id": "CVE-2025-68428", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-68428", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T15:35:22.371810Z", "version": "2.0.3" } } ] }, "published": "2026-01-05T22:15:51.977", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d" }, { "source": "security-advisories@github.com", "tags": [ "Product", "Release Notes" ], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.0.0" }, { "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:1517" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2350" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2568" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2025-68428" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427236" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68428.json" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-35" }, { "lang": "en", "value": "CWE-73" } ], "source": "security-advisories@github.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-73" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ] } }
product	jsPDF receipt Source NVD Its words `jsPDF` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "jsPDF", "vendor": "parallax", "versions": [ { "status": "affected", "version": "< 4.0.0" } ] } ], "source": "security-advisories@github.com" }, { "affectedData": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.8::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1769615659", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.9::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1770074713", "versionType": "rpm" }, { "lessThan": "", "status": "unaffected", "version": "1770250889", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-rhel8-operator", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:parall:jspdf::::::node.js::", "matchCriteriaId": "1EED4B66-0CA7-43D9-A73B-505062F90B4D", "versionEndExcluding": "4.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF." }, { "lang": "es", "value": "jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versión 4.0.0, el control del usuario sobre el primer argumento del método loadFile en la compilación de node.js permite la inclusión local de ficheros/salto de ruta. Si se le da la posibilidad de pasar rutas no saneadas al método loadFile, un usuario puede recuperar el contenido de ficheros arbitrarios en el sistema de ficheros local en el que se está ejecutando el proceso de node. El contenido de los ficheros se incluye textualmente en los PDFs generados. Otros métodos afectados son 'addImage', 'html' y 'addFont'. Solo las compilaciones de node.js de la biblioteca están afectadas, concretamente los ficheros 'dist/jspdf.node.js' y 'dist/jspdf.node.min.js'. La vulnerabilidad ha sido corregida en jsPDF@4.0.0. Esta versión restringe el acceso al sistema de ficheros por defecto. Esta actualización semver-major no introduce otros cambios disruptivos. Algunas soluciones alternativas están disponibles. Con las versiones recientes de node, jsPDF recomienda usar la bandera '--permission' en producción. La característica fue introducida experimentalmente en v20.0.0 y es estable desde v22.13.0/v23.5.0/v24.0.0. Para versiones de node más antiguas, sanee las rutas proporcionadas por el usuario antes de pasarlas a jsPDF." } ], "id": "CVE-2025-68428", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-68428", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T15:35:22.371810Z", "version": "2.0.3" } } ] }, "published": "2026-01-05T22:15:51.977", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d" }, { "source": "security-advisories@github.com", "tags": [ "Product", "Release Notes" ], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.0.0" }, { "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:1517" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2350" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2568" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2025-68428" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427236" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68428.json" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-35" }, { "lang": "en", "value": "CWE-73" } ], "source": "security-advisories@github.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-73" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ] } }
status	Modified receipt Source NVD Its words `Modified` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "jsPDF", "vendor": "parallax", "versions": [ { "status": "affected", "version": "< 4.0.0" } ] } ], "source": "security-advisories@github.com" }, { "affectedData": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.8::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1769615659", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.9::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1770074713", "versionType": "rpm" }, { "lessThan": "", "status": "unaffected", "version": "1770250889", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-rhel8-operator", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:parall:jspdf::::::node.js::", "matchCriteriaId": "1EED4B66-0CA7-43D9-A73B-505062F90B4D", "versionEndExcluding": "4.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF." }, { "lang": "es", "value": "jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versión 4.0.0, el control del usuario sobre el primer argumento del método loadFile en la compilación de node.js permite la inclusión local de ficheros/salto de ruta. Si se le da la posibilidad de pasar rutas no saneadas al método loadFile, un usuario puede recuperar el contenido de ficheros arbitrarios en el sistema de ficheros local en el que se está ejecutando el proceso de node. El contenido de los ficheros se incluye textualmente en los PDFs generados. Otros métodos afectados son 'addImage', 'html' y 'addFont'. Solo las compilaciones de node.js de la biblioteca están afectadas, concretamente los ficheros 'dist/jspdf.node.js' y 'dist/jspdf.node.min.js'. La vulnerabilidad ha sido corregida en jsPDF@4.0.0. Esta versión restringe el acceso al sistema de ficheros por defecto. Esta actualización semver-major no introduce otros cambios disruptivos. Algunas soluciones alternativas están disponibles. Con las versiones recientes de node, jsPDF recomienda usar la bandera '--permission' en producción. La característica fue introducida experimentalmente en v20.0.0 y es estable desde v22.13.0/v23.5.0/v24.0.0. Para versiones de node más antiguas, sanee las rutas proporcionadas por el usuario antes de pasarlas a jsPDF." } ], "id": "CVE-2025-68428", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-68428", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T15:35:22.371810Z", "version": "2.0.3" } } ] }, "published": "2026-01-05T22:15:51.977", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d" }, { "source": "security-advisories@github.com", "tags": [ "Product", "Release Notes" ], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.0.0" }, { "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:1517" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2350" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2568" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2025-68428" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427236" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68428.json" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-35" }, { "lang": "en", "value": "CWE-73" } ], "source": "security-advisories@github.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-73" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ] } }
vendor	parallax receipt Source NVD Its words `parallax` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "jsPDF", "vendor": "parallax", "versions": [ { "status": "affected", "version": "< 4.0.0" } ] } ], "source": "security-advisories@github.com" }, { "affectedData": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.8::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.8", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1769615659", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.9::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.9", "vendor": "Red Hat", "versions": [ { "lessThan": "", "status": "unaffected", "version": "1770074713", "versionType": "rpm" }, { "lessThan": "", "status": "unaffected", "version": "1770250889", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-rhel8-operator", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4" ], "defaultStatus": "unaffected", "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:parall:jspdf::::::node.js::", "matchCriteriaId": "1EED4B66-0CA7-43D9-A73B-505062F90B4D", "versionEndExcluding": "4.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF." }, { "lang": "es", "value": "jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versión 4.0.0, el control del usuario sobre el primer argumento del método loadFile en la compilación de node.js permite la inclusión local de ficheros/salto de ruta. Si se le da la posibilidad de pasar rutas no saneadas al método loadFile, un usuario puede recuperar el contenido de ficheros arbitrarios en el sistema de ficheros local en el que se está ejecutando el proceso de node. El contenido de los ficheros se incluye textualmente en los PDFs generados. Otros métodos afectados son 'addImage', 'html' y 'addFont'. Solo las compilaciones de node.js de la biblioteca están afectadas, concretamente los ficheros 'dist/jspdf.node.js' y 'dist/jspdf.node.min.js'. La vulnerabilidad ha sido corregida en jsPDF@4.0.0. Esta versión restringe el acceso al sistema de ficheros por defecto. Esta actualización semver-major no introduce otros cambios disruptivos. Algunas soluciones alternativas están disponibles. Con las versiones recientes de node, jsPDF recomienda usar la bandera '--permission' en producción. La característica fue introducida experimentalmente en v20.0.0 y es estable desde v22.13.0/v23.5.0/v24.0.0. Para versiones de node más antiguas, sanee las rutas proporcionadas por el usuario antes de pasarlas a jsPDF." } ], "id": "CVE-2025-68428", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-68428", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T15:35:22.371810Z", "version": "2.0.3" } } ] }, "published": "2026-01-05T22:15:51.977", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d" }, { "source": "security-advisories@github.com", "tags": [ "Product", "Release Notes" ], "url": "https://github.com/parallax/jsPDF/releases/tag/v4.0.0" }, { "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ], "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:1517" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2350" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:2568" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2025-68428" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427236" }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68428.json" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-35" }, { "lang": "en", "value": "CWE-73" } ], "source": "security-advisories@github.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-73" } ], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary" } ] } }

Text

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF. jsPDF es una biblioteca para generar PDFs en JavaScript. Antes de la versión 4.0.0, el control del usuario sobre el primer argumento del método loadFile en la compilación de node.js permite la inclusión local de ficheros/salto de ruta. Si se le da la posibilidad de pasar rutas no saneadas al método loadFile, un usuario puede recuperar el contenido de ficheros arbitrarios en el sistema de ficheros local en el que se está ejecutando el proceso de node. El contenido de los ficheros se incluye textualmente en los PDFs generados. Otros métodos afectados son 'addImage', 'html' y 'addFont'. Solo las compilaciones de node.js de la biblioteca están afectadas, concretamente los ficheros 'dist/jspdf.node.js' y 'dist/jspdf.node.min.js'. La vulnerabilidad ha sido corregida en jsPDF@4.0.0. Esta versión restringe el acceso al sistema de ficheros por defecto. Esta actualización semver-major no introduce otros cambios disruptivos. Algunas soluciones alternativas están disponibles. Con las versiones recientes de node, jsPDF recomienda usar la bandera '--permission' en producción. La característica fue introducida experimentalmente en v20.0.0 y es estable desde v22.13.0/v23.5.0/v24.0.0. Para versiones de node más antiguas, sanee las rutas proporcionadas por el usuario antes de pasarlas a jsPDF.