jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.
The loadFile method (as well as addImage, html, and addFont) accepts a file path controlled by the user without prior verification or sanitization. An attacker who can pass an unsanitized path to this method can use path traversal sequences (e.g., ../../../etc/passwd) to point to any file accessible to the Node.js process. The contents of the pointed file are then included verbatim in the generated PDF document. The issue affects only Node.js builds of the library: dist/jspdf.node.js and dist/jspdf.node.min.js files.
An attacker can read arbitrary files from the local file system of the server running the Node.js process — including configuration files, private keys, credentials, or other sensitive data (high confidentiality breach). No possibility of data modification or availability disruption was found.
Update jsPDF to version 4.0.0, which by default restricts file system access. As a workaround for production environments with Node.js v22.13.0/v23.5.0/v24.0.0 or newer, it is recommended to run the process with the --permission flag. On older Node.js versions, all user-supplied paths should be sanitized before being passed to jsPDF.
jsPDF library in all versions before 4.0.0, Node.js builds only (dist/jspdf.node.js and dist/jspdf.node.min.js files)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XParall Jspdf
APPParall< 4.0.0
Related vulnerabilities
XSS w bibliotece jsPDF — wstrzyknięcie skryptów przez argument output()
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `c...
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS`...
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `...
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of t...