CVE-2025-68428: Jspdf Path Traversal Vulnerability

CRITICAL
Advisory Identifier: GHSA-f8cm-6447-x5h2
Share
CWE-35 CWE-73 CWE-22
Published
Advisory Summary

CVE-2025-68428 is a CRITICAL path traversal vulnerability (CWE-35: Path Traversal: '.../...//') affecting Jspdf libraries in the npm ecosystem. The issue involves jspdf has local file inclusion/path traversal vulnerability. Remediation is available by upgrading affected packages to version 4.0.0.

CVE-2025-68428 at a Glance

CVE Identifier CVE-2025-68428
GHSA Identifier GHSA-f8cm-6447-x5h2
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-35: Path Traversal: '.../...//'
Affected Product Jspdf
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2025-68428

To remediate this vulnerability, upgrade all affected Jspdf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

jspdf fixed: 4.0.0 
npm install jspdf@4.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls jspdf

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-68428, inspect your project dependencies using npm:

npm ls jspdf

Analyze the terminal output to locate any version of Jspdf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.0.0), your application is affected.

Note: The npm ls jspdf command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-35: Path Traversal: '.../...//', where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. In Jspdf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are: `addImage`, `html`, `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. Example attack vector: ```js import { jsPDF } from "./dist/jspdf.node.js"; const doc = new jsPDF(); doc.addImage("./secret.txt", "JPEG", 0, 0, 10, 10); doc.save("test.pdf"); // the generated PDF will contain the "secret.txt" file ``` ### Patches The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. ### Workarounds With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. See the [node documentation](https://nodejs.org/api/permissions.html) for details. For older node versions, sanitize user-provided paths before passing them to jsPDF. ### Credits Researcher: kilkat (Kwangwoon Kim)

CVE-2025-68428 Affected Jspdf Versions

1 component(s)
Fixed Versions:
4.0.0
Product / Package Ecosystem Affected Versions Fixed Version
jspdf
npm/jspdf
npm
< 4.0.0
4.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
NVD — CVE-2025-68428 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68428
Security Fix Commit FIX COMMIT
https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
Jspdf Source Repository REPOSITORY
https://github.com/parallax/jsPDF
Jspdf Release RELEASE
https://github.com/parallax/jsPDF/releases/tag/v4.0.0

Frequently Asked Questions

What is CVE-2025-68428?
CVE-2025-68428 is a security vulnerability in Jspdf involving jsPDF has Local File Inclusion/Path Traversal vulnerability under CWE-35: Path Traversal: '.../...//'.
Which Jspdf versions are affected?
Affected versions include releases prior to 4.0.0 across affected packages: jspdf.
What version fixes CVE-2025-68428?
Upgrading to 4.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is jspdf affected?
Yes, jspdf is affected in releases prior to 4.0.0. Upgrade your dependency to 4.0.0 or later.
What CWE is associated with CVE-2025-68428?
CVE-2025-68428 is classified under CWE-35: Path Traversal: '.../...//' (The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.).
How can I check npm dependencies for CVE-2025-68428?
Run the dependency tree command: 'npm ls jspdf'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f8cm-6447-x5h2",
  "modified" : "2026-01-06T15:51:57Z",
  "published" : "2026-01-05T17:35:29Z",
  "aliases" : [ "CVE-2025-68428" ],
  "summary" : "jsPDF has Local File Inclusion/Path Traversal vulnerability",
  "details" : "### Impact\nUser control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.\n\nIf given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs.\n\nOther affected methods are: `addImage`, `html`, `addFont`.\n\nOnly the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"./dist/jspdf.node.js\";\n\nconst doc = new jsPDF();\n\ndoc.addImage(\"./secret.txt\", \"JPEG\", 0, 0, 10, 10);\ndoc.save(\"test.pdf\"); // the generated PDF will contain the \"secret.txt\" file\n```\n\n### Patches\nThe vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes.\n\n### Workarounds\nWith recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. See the [node documentation](https://nodejs.org/api/permissions.html) for details.\n\nFor older node versions, sanitize user-provided paths before passing them to jsPDF.\n\n### Credits\nResearcher: kilkat (Kwangwoon Kim)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "jspdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.0.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-68428"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/parallax/jsPDF"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/parallax/jsPDF/releases/tag/v4.0.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-35", "CWE-73" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-05T17:35:29Z",
    "nvd_published_at" : "2026-01-05T22:15:51Z"
  }
}