FixVibe
Research notehigh

CVE-2025-68428: Path Traversal in jsPDF Node.js Build

A high-severity vulnerability (CVE-2025-68428) has been identified in the jsPDF library. In Node.js environments, the loadFile method fails to properly sanitize the first argument, allowing attackers to perform path traversal and local file inclusion (LFI). This can lead to unauthorized access to sensitive server-side files if user input is passed directly to the method.

CVE-2025-68428CWE-22CWE-35CWE-73

Impact

An attacker can read sensitive local files from the server's filesystem by exploiting a path traversal vulnerability in the loadFile method [S1]. This occurs when an application using the Node.js build of jsPDF passes unsanitized user input into the first argument of this method [S1].

Root Cause

The root cause is a lack of input validation and sanitization in the loadFile method within the jsPDF Node.js build [S1]. Specifically, the method does not restrict the file path provided as the first argument, allowing directory traversal sequences (like ../) to escape the intended directory and access arbitrary files on the host system [S1]. This issue affects all versions of jsPDF prior to 4.0.0 [S1].

How FixVibe could detect it

FixVibe could detect this vulnerability through several scanning modes:

  • Repository Scanning: By analyzing package.json or lock files (e.g., package-lock.json, yarn.lock), FixVibe can identify if a project is using a version of jspdf earlier than 4.0.0 [S1].
  • Static Analysis (SAST): FixVibe's code scanner could look for patterns where user-controlled data (from request parameters, headers, or database fields) is passed directly into the loadFile method of a jsPDF instance without prior sanitization.
  • Active Probing: If an application exposes an endpoint that generates PDFs based on user-provided file paths or templates, FixVibe could attempt to inject path traversal sequences to verify if the server attempts to load unauthorized local files.

Remediation

To mitigate this vulnerability, developers should:

  • Upgrade jsPDF: Update the jspdf dependency to version 4.0.0 or later, where this issue has been addressed [S1].
  • Sanitize Inputs: If upgrading is not immediately possible, ensure that any input passed to loadFile is strictly validated against an allowlist or sanitized to remove traversal characters like .., /, and \ [S1].
CVE-2025-68428: Path Traversal in jsPDF Node.js Build — FixVibe research · FixVibe