Executive brief
SurveyJS survey-pdf is a Node.js library that generates PDF documents from survey definitions. A vulnerability in its bundled jsPDF dependency allows attackers to read arbitrary files from the server's file system and embed their contents into generated PDFs, potentially exposing sensitive configuration files, credentials, or source code. Upgrading to patched versions (1.12.59 or 2.5.5+) is required to remediate the risk.
Technical details
The vulnerability is a local file inclusion (LFI) / path traversal flaw in jsPDF's Node.js build (dist/jspdf.node.js and dist/jspdf.node.min.js). When applications pass unsanitized user input to jsPDF methods such as loadFile(), addImage(), html(), or addFont(), an attacker can traverse the file system and read arbitrary files accessible to the Node.js process. The retrieved file contents are then embedded verbatim into the generated PDF. The vulnerability affects jsPDF versions ≤3.0.4 and is network-reachable if the application exposes PDF generation endpoints. No authentication or user interaction is required. The fix (jsPDF 4.0.0+) restricts file system access by default; survey-pdf versions 1.12.59 and 2.5.5+ upgrade to the patched jsPDF and are fully backward-compatible.
Affected products
- SurveyJS survey-pdf <=1.12.58, <=2.5.4
- parallax jsPDF <=3.0.4
Timeline
- 2026-02-04: disclosed: GHSA-h3q6-jfrg-3x6q published
- 2026-02-04: patched: survey-pdf versions 1.12.59 and 2.5.5 released with jsPDF 4.0.0+