CVE-2025-68428 parallax CVE debrief

Who should care

Developers using jsPDF in node.js environments should be concerned about this vulnerability. Given the critical severity (CVSS score of 9.2), immediate attention is required to prevent potential local file inclusion and path traversal attacks. Users of jsPDF in browser environments are not affected. Red Hat users should also review the provided errata for potential impacts.

Technical summary

The vulnerability in jsPDF arises from the lack of sanitization in the loadFile method of the node.js build. This method, along with addImage, html, and addFont, can be exploited for local file inclusion and path traversal. An attacker could leverage this to access sensitive files on the system where the node process runs. The fix in version 4.0.0 restricts file system access by default, mitigating the issue. For older node versions lacking the --permission flag, path sanitization is recommended as a workaround.

Defensive priority

High. Given the critical CVSS score and the potential for local file inclusion and path traversal, defenders should prioritize updating jsPDF to version 4.0.0 or applying recommended workarounds immediately.

Recommended defensive actions

• Update jsPDF to version 4.0.0 or later to restrict file system access by default.
• For environments using older node versions, implement path sanitization for user-provided paths before passing them to jsPDF.
• Review and apply Red Hat errata if applicable.
• Use the --permission flag in production for recent node versions.
• Monitor for suspicious activity related to file access patterns.

Evidence notes

The CVE-2025-68428 vulnerability details are based on information from the NVD and jsPDF's official GitHub repository. The vulnerability allows for local file inclusion and path traversal in node.js builds of jsPDF prior to version 4.0.0. Fixes and workarounds are provided, including updating to version 4.0.0 and path sanitization for older node versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.