High · published January 6, 2026
🚨 A local file inclusion vulnerability in jsPDF prior to version 4.0.0 lets users snoop around your server, retrieving any file they want! 🔥 Imagine a sneaky delivery person who, instead of just leaving your package at the door, opens your mailbox and starts reading your personal letters. This is what's happening with jsPDF when it blindly trusts input for retrieving files, allowing attackers to access sensitive data without permission. An attacker can exploit this vulnerability to obtain the contents of any file on the server where the node process runs, including sensitive information like configuration files or user data. This could lead to an absolute disaster if an attacker gets hold of private keys or credentials, potentially compromising the entire system!
Imagine a sneaky delivery person who, instead of just leaving your package at the door, opens your mailbox and starts reading your personal letters. This is what's happening with jsPDF when it blindly trusts input for retrieving files, allowing attackers to access sensitive data without permission. This vulnerability arises from unsanitized paths passed to the loadFile method in jsPDF's node.js builds, which allows attackers to perform path traversal and access arbitrary files on the server's filesystem. Affected methods include `addImage`, `html`, and `addFont`, all of which can expose sensitive data in generated PDFs.
An attacker can exploit this vulnerability to obtain the contents of any file on the server where the node process runs, including sensitive information like configuration files or user data. This could lead to an absolute disaster if an attacker gets hold of private keys or credentials, potentially compromising the entire system! Upgrade to jsPDF version 4.0.0 or later immediately to resolve this critical issue, as it restricts file system access by default. Additionally, for older Node.js versions, make sure to sanitize any user-provided paths before passing them to jsPDF to prevent exploitation. Consider using the `--permission` flag in newer Node.js versions for added security. You've got this! By following these steps, you can protect your applications and maintain your heroic security status! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| parall/jspdf | < 4.0.0 | 4.0.0 |