Critical Flaw in jsPDF Library Allows Attackers to Read Arbitrary Files

Back Cyberpress

Critical Flaw in jsPDF Library Allows Attackers to Read Arbitrary Files

Cyberpress • January 7, 2026

Share: View original

In a real-world attack scenario, a threat actor could manipulate input to reference critical system files. For example, by passing a path like ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical jsPDF Vulnerability Allows File Theft via PDF Generation The jsPDF library, used for generating PDF documents in JavaScript applications, has a critical vulnerability that enables attackers to steal sensitive data from the local filesystem. This flaw, tracked as CVE-2025-68428, is a local file inclusion and path traversal issue affecting jsPDF versions prior to 4.0, with a severity score of 9.2. Attackers can exploit this vulnerability by passing unsanitized paths to the file loading mechanism. 4 sources 52

Extracted Entities

Platforms (1)