Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-t6gm-egg6-eua6
Vulnerability ID VCID-t6gm-egg6-eua6
Aliases CVE-2025-68428
GHSA-f8cm-6447-x5h2
Summary jsPDF has Local File Inclusion/Path Traversal vulnerability User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are: `addImage`, `html`, `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. Example attack vector: ```js import { jsPDF } from "./dist/jspdf.node.js"; const doc = new jsPDF(); doc.addImage("./secret.txt", "JPEG", 0, 0, 10, 10); doc.save("test.pdf"); // the generated PDF will contain the "secret.txt" file ```
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-35 Path Traversal: '.../...//'
CWE-73 External Control of File Name or Path
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
cvssv3 8.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68428.json
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-68428
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-68428
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-68428
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-68428
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-68428
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-f8cm-6447-x5h2
cvssv4 9.2 https://github.com/parallax/jsPDF
generic_textual CRITICAL https://github.com/parallax/jsPDF
cvssv4 9.2 https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
generic_textual CRITICAL https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
ssvc Track https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
cvssv4 9.2 https://github.com/parallax/jsPDF/releases/tag/v4.0.0
generic_textual CRITICAL https://github.com/parallax/jsPDF/releases/tag/v4.0.0
ssvc Track https://github.com/parallax/jsPDF/releases/tag/v4.0.0
cvssv3.1_qr CRITICAL https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
cvssv4 9.2 https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
generic_textual CRITICAL https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
ssvc Track https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
cvssv4 9.2 https://nvd.nist.gov/vuln/detail/CVE-2025-68428
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-68428
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68428.json
https://api.first.org/data/v1/epss?cve=CVE-2025-68428
https://github.com/parallax/jsPDF
https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
https://github.com/parallax/jsPDF/releases/tag/v4.0.0
2427236 https://bugzilla.redhat.com/show_bug.cgi?id=2427236
CVE-2025-68428 https://nvd.nist.gov/vuln/detail/CVE-2025-68428
GHSA-f8cm-6447-x5h2 https://github.com/advisories/GHSA-f8cm-6447-x5h2
GHSA-f8cm-6447-x5h2 https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
RHSA-2026:1517 https://access.redhat.com/errata/RHSA-2026:1517
RHSA-2026:2350 https://access.redhat.com/errata/RHSA-2026:2350
RHSA-2026:2568 https://access.redhat.com/errata/RHSA-2026:2568
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68428.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/parallax/jsPDF
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-06T15:35:22Z/ Found at https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/parallax/jsPDF/releases/tag/v4.0.0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-06T15:35:22Z/ Found at https://github.com/parallax/jsPDF/releases/tag/v4.0.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-06T15:35:22Z/ Found at https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-68428
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09162
EPSS Score 0.0003
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:49:22.533229+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jspdf/CVE-2025-68428.yml 38.6.0