jsPDF versions prior to 4.0.0 contain a path traversal vulnerability in the node.js build. User input controlling the first argument of the loadFile method can lead to local file inclusion, allowing an attacker to read arbitrary files from the local file system. The file contents are included verbatim in generated PDFs. This affects only the node.js builds (dist/jspdf.node.js and dist/jspdf.node.min.js) and related methods addImage, html, and addFont. The issue is resolved in version 4.0.0 by restricting file system access by default. The vulnerability is tracked as CVE-2025-68428 with a CVSS 4.0 base score of 9.2 (critical). Vendor advisories confirm the fix and recommend upgrading to 4.0.0 or later. Some mitigations like using the node --permission flag are suggested for production environments.

An attacker able to pass unsanitized paths to the loadFile method in the vulnerable jsPDF node.js builds can read arbitrary files on the local file system accessible to the node process. This compromises confidentiality by exposing sensitive local files. The vulnerability does not require privileges or user interaction and can be exploited remotely if the application exposes this functionality. The vulnerability does not impact integrity or availability directly but could lead to information disclosure. No known active exploits have been reported.

A fixed version of jsPDF is available: upgrade to version 4.0.0 or later, which restricts file system access by default. For environments where upgrading is not immediately possible, mitigations include sanitizing input paths passed to loadFile and related methods, and using recent Node.js versions with the --permission flag to restrict file system access. Vendor advisories note that no other official mitigations meet their criteria, so upgrading is strongly recommended.