Security readout for executives and security teams
Plain-English summary
A vulnerable server using jsPDF can be tricked into placing local files—potentially secrets, configuration, or application data—inside a generated PDF. The issue is critical when untrusted users can influence file paths. It affects only jsPDF’s Node.js builds before version 4.0.0, not every use of the library.
Executive priority
Treat internet-facing or multi-tenant PDF services as urgent: identify vulnerable Node.js deployments and upgrade promptly. Prioritize systems processing customer-controlled filenames, templates, images, HTML, or fonts because successful abuse could disclose secrets through apparently normal PDF output.
Technical view
In jsPDF before 4.0.0, unsanitized path input reaching loadFile, addImage, html, or addFont can cause local file inclusion and path traversal. The Node.js process reads the selected file and embeds its contents verbatim in the generated PDF. Only dist/jspdf.node.js and dist/jspdf.node.min.js are identified as affected.
Likely exposure
Exposure is highest in server-side PDF-generation services using jsPDF’s Node.js builds below 4.0.0 where remote or otherwise untrusted input influences paths passed to affected methods. Browser-only builds, upgraded deployments, and applications without user-controlled path flow are not identified as vulnerable by the supplied sources.
Exploitation context
The supplied bundle reports network-reachable, low-complexity exploitation without privileges or user interaction, with high confidentiality impact. It does not provide evidence of active exploitation, and the KEV indicator is false. Practical exploitability still depends on untrusted path input reaching an affected method and the Node.js process having access to valuable files.
Researcher notes
The advisory maps the flaw to CWE-35 and CWE-73 and assigns CVSS 4.0 score 9.2. Scope is explicitly limited to Node.js distribution builds. The bundle names no public exploit or observed campaign. Review data flow and process filesystem permissions; package presence alone does not establish reachability.
Mitigation direction
- Upgrade jsPDF to version 4.0.0 or later.
- Prevent untrusted paths from reaching loadFile, addImage, html, or addFont.
- On supported Node.js versions, use the production permission controls recommended by jsPDF.
- For older Node.js versions, strictly sanitize and allowlist user-provided paths.
Validation and detection
- Inventory jsPDF versions used by production and build-time dependencies.
- Confirm whether applications load either identified Node.js distribution file.
- Trace untrusted inputs into loadFile, addImage, html, and addFont.
- Verify version 4.0.0 rejects unauthorized filesystem access by default.
- Retest legitimate PDF, image, HTML, and font workflows after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-35: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-68428 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94redhat-SADPVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-05T22:01:15.703Z: Reported to Red Hat.
- 2026-01-05T21:43:55.169Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066dCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/parallax/jsPDF/releases/tag/v4.0.0CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2025-68428CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2427236CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68428.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:1517CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2350CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2568CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Path Traversal: '.../...//'
Path Traversal: '.../...//' represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.