CVE-2025-68428: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68428 is a Local File Inclusion (LFI) / Path Traversal vulnerability in the Node.js build of the jsPDF library (parallax/jsPDF). It allows an attacker who can control file path arguments passed to jsPDF methods to read arbitrary files from the server's local file system, with the file contents embedded verbatim into generated PDFs. All versions up to and including 3.0.4 of the jspdf npm package are affected; only the Node.js builds (dist/jspdf.node.js and dist/jspdf.node.min.js) are vulnerable. The vulnerability was published on January 3, 2026, and assigned a CVSS v4.0 base score of 9.2 (Critical) and a CVSS v3.1 base score of 7.5 (High) (Github Advisory, jsPDF Security Advisory).

The root cause is improper external control of file name or path (CWE-73) combined with path traversal weaknesses (CWE-22, CWE-35): the loadFile method in the Node.js build directly passes user-supplied path arguments to Node's fs.readFileSync without sanitization or restriction, allowing traversal outside any intended directory. The affected methods are loadFile, addImage, html, and addFont — all of which accept file paths as their first argument. An attacker who can influence these arguments (e.g., via a web application that accepts user-controlled filenames for PDF generation) can supply paths such as ../../etc/passwd or ./secret.txt to exfiltrate arbitrary files accessible to the Node.js process. The fix in commit a688c8f introduced a whitelist mechanism (jsPDF.allowFsRead) and integration with Node's --permission flag to restrict file system access by default (jsPDF Commit, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server's file system that are accessible to the Node.js process, with file contents embedded verbatim into the generated PDF output. This can expose highly sensitive data including credentials, API keys, environment variable files (.env), configuration files, SSH private keys, and application source code. There is no integrity or availability impact, but the confidentiality breach can facilitate further attacks such as credential theft, lateral movement, or full application compromise (Github Advisory, jsPDF Security Advisory).

A public proof-of-concept (PoC) repository exists at https://github.com/12nio/CVE-2025-68428_PoC, and the vulnerability has been referenced in social media posts and threat intelligence feeds. The EPSS score is approximately 0.03% (0.000590), indicating a low but non-zero probability of exploitation in the wild within 30 days. There is no confirmed evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. No specific threat actor attribution has been made (Github Advisory, Feedly).

1. Reconnaissance: Identify web applications or services that use jsPDF's Node.js build (versions ≤ 3.0.4) and accept user-controlled input for PDF generation (e.g., image URLs, font paths, or HTML content passed to addImage, addFont, html, or loadFile).
2. Identify injection point: Locate an API endpoint or form field that passes user-supplied file paths directly to a jsPDF method without sanitization.
3. Craft malicious payload: Construct a path traversal string targeting a sensitive file, such as ../../etc/passwd, ../../.env, or an absolute path like /etc/shadow, and supply it as the file path argument to the vulnerable method (e.g., doc.addImage('../../.env', 'JPEG', 0, 0, 10, 10)).
4. Trigger PDF generation: Submit the crafted request to cause the server-side Node.js process to call fs.readFileSync on the attacker-controlled path.
5. Retrieve exfiltrated data: Download or receive the generated PDF, which will contain the contents of the targeted file embedded verbatim within the PDF output.
6. Escalate: Use extracted credentials, API keys, or configuration data to pivot to further attacks against the application or infrastructure (Github Advisory, jsPDF Commit).

• Network: Unusual or repeated requests to PDF generation endpoints with file path parameters containing traversal sequences (e.g., ../, ../../, absolute paths like /etc/) in image, font, or HTML source fields.
• Logs: Application or web server logs showing requests with path traversal patterns in parameters passed to jsPDF methods; Node.js process logs showing fs.readFileSync calls on unexpected file paths.
• File System: Generated PDF files on disk containing plaintext content from sensitive system files (e.g., /etc/passwd, .env files) embedded within the PDF binary.
• Process: Node.js process accessing files outside the expected application directory (e.g., /etc/, /root/, ~/.ssh/) as observed via auditd, strace, or similar process monitoring tools.

The vulnerability is fixed in jsPDF version 4.0.0, which restricts file system access by default and introduces the jsPDF.allowFsRead whitelist property for explicitly permitted paths. Upgrading to v4.0.0 or later is the primary recommended remediation. For environments that cannot immediately upgrade, two workarounds are available: (1) use Node.js v20.0.0+ with the --permission --allow-fs-read=<allowed-paths> flags (stable since v22.13.0/v23.5.0/v24.0.0) to enforce runtime-level file access restrictions; (2) sanitize and validate all user-provided file paths before passing them to any jsPDF method. Additionally, IBM has released patches for affected products including IBM Cloud Pak for Business Automation, IBM Rapid Infrastructure Automation, and IBM API Connect (jsPDF Release v4.0.0, Github Advisory, IBM Advisory).

The vulnerability received notable coverage from security media outlets including CSO Online, Security Boulevard, The Hacker News (in a weekly recap), and CyberPress, highlighting the risk of server-side file theft via PDF generation. Security researchers and community members discussed the flaw on Reddit, LinkedIn, Bluesky, and Mastodon, with several posts emphasizing the ease of exploitation in applications that accept user-controlled file paths. The Emerging Threats ruleset was updated (v11103, January 14, 2026) to include detection rules for this vulnerability. IBM issued multiple security bulletins acknowledging the impact on their enterprise products (CSO Online, Emerging Threats, IBM Advisory).