CVE-2025-68428

CVE-2025-68428 is a critical local file inclusion/path traversal vulnerability in jsPDF, a JavaScript PDF generation library, specifically affecting its Node.js builds prior to version 4.0.0. This flaw allows an attacker to retrieve the contents of arbitrary files on the local file system by providing unsanitized paths to methods like loadFile, addImage, html, or addFont, with the file contents then embedded in generated PDFs. Rated with a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to a high impact on confidentiality. The FAUCET Risk Score is 85/100, indicating significant risk. While there is no evidence of active exploitation (KEV: No), the vulnerability has garnered considerable community attention with 3 mentions and 3 media articles, including reports from BleepingComputer and SecurityWeek, highlighting its critical nature. No public exploit code (Metasploit, Nuclei, ExploitDB) is currently available.