Loading vulnerability…
CVE-2025-68428 is a critical local file inclusion and path traversal vulnerability in jsPDF affecting the Node.js builds prior to version 4.0.0. The flaw arises because user-controlled input can influence the first argument passed to the loadFile method without adequate path restriction or sanitization. As a result, an attacker who can supply an unsanitized path can cause the library to read arbitrary files accessible to the Node.js process. The retrieved file contents are then embedded verbatim into generated PDF output. The issue also affects higher-level methods including addImage, html, and addFont, which rely on the same file-loading behavior. Browser-only usage is not affected; the vulnerable surface is limited to the Node.js distributions of jsPDF.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-68428, demonstrating a file read/path traversal vulnerability in a Node.js Express service that uses jsPDF. The repository contains four files: a Dockerfile (sets up the environment and creates a '/secret' file), a README.md (usage instructions and screenshots), a package.json (declares dependencies: express and jsPDF), and poc.js (the main exploit server). The poc.js file exposes an HTTP endpoint '/api/v1/generate-invoice' that takes a 'branding' query parameter. This parameter is used as a file path and passed directly to jsPDF's addImage function, allowing an attacker to supply arbitrary file paths (such as '../secret') to read files from the server's filesystem. The exploit demonstrates this by reading the '/secret' file created in the Docker image and embedding its contents into a generated PDF, which is then returned to the user. The attack vector is network-based, requiring HTTP access to the vulnerable endpoint. The PoC is operational and demonstrates the vulnerability but does not weaponize it beyond file read. No external C2 or hardcoded IPs/domains are present.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical vulnerability in jsPDF where user control over the first argument to loadFile enables local file inclusion and path traversal. By supplying an unsanitized path, an attacker can read arbitrary files from the filesystem of the Node.js process, and jsPDF embeds the file contents directly into the generated PDF. Similar exposure is noted in addImage, html, and addFont methods.
A critical path traversal and local file inclusion vulnerability in jsPDF (Node.js builds, versions 3.0.4 and earlier) allows attackers to read arbitrary files from the server filesystem and embed them into generated PDFs.
A critical vulnerability in the jsPDF library that allows attackers to steal files from the server side.
A critical path traversal vulnerability in the jsPDF npm package allowing attackers to retrieve arbitrary file contents from the local file system in Node.js environments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.