CVE-2025-68428 — jsPDF is a library to generate PDFs in JavaScript.¶
Key facts
CVE-2025-68428 is a High (7.5) vulnerability: jsPDF is a library to generate PDFs in JavaScript.. This entry ships a detection-only PoC and a Docker test lab.
| CVE | CVE-2025-68428 |
| Severity | High (7.5) |
| Detection / prevention | — |
| PoC | poc.py |
| Source | 2025/CVE-2025-68428/ |
Details¶
English | 한국어
Description¶
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are addImage, html, and addFont. Only the node.js builds of the library are affected, namely the dist/jspdf.node.js and dist/jspdf.node.min.js files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the --permission flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.
Vulnerability Details¶
| Property | Value |
|---|---|
| CVE ID | CVE-2025-68428 |
| Type | LFI |
| CVSS Score | 7.5 |
Proof of Concept¶
Download¶
# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2025/CVE-2025-68428/poc.py
Usage¶
# Run PoC against target
python3 poc.py --target <TARGET_URL>
# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>
⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.
Test Lab¶
This repository includes a Docker-based test environment with both vulnerable and patched applications.
Quick Start¶
# Clone and navigate to CVE directory
cd CVE-2025-68428
# Start both applications
docker-compose up -d
# Run tests
./run-tests.sh # Linux/Mac
./run-tests.ps1 # Windows PowerShell
Application Endpoints¶
| Application | URL | Status |
|---|---|---|
| Vulnerable App | http://localhost:8080 | Shows vulnerability |
| Patched App | http://localhost:8081 | Demonstrates fix |
Directory Structure¶
├── README.md # English documentation
├── README_KO.md # Korean documentation
├── poc.py # PoC detection script
├── docker-compose.yml # Container orchestration
├── run-tests.sh # Linux/Mac test runner
├── run-tests.ps1 # Windows test runner
├── vulnerable-app/ # Vulnerable version
│ ├── app.py
│ ├── Dockerfile
│ └── requirements.txt
└── patched-app/ # Fixed version
├── app.py
├── Dockerfile
└── requirements.txt
References¶
- https://github.com/parallax/jsPDF/commit/a688c8f479929b24a6543b1fa2d6364abb03066d
- https://github.com/parallax/jsPDF/releases/tag/v4.0.0
- https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
Generated by PoC Generator on 2026-01-23T18:59:47.245871412
Frequently asked questions¶
What is CVE-2025-68428?¶
CVE-2025-68428 is a High (7.5) vulnerability: jsPDF is a library to generate PDFs in JavaScript.. This entry ships a detection-only PoC and a Docker test lab.
How do I detect CVE-2025-68428?¶
Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.
How do I block or mitigate CVE-2025-68428?¶
Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.
For authorized security testing and research only. See the full source and NVD record.