CVE-2026-114491
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Risk Assessment
This can lead to leakage of sensitive server-side files when an application generates PDFs from user-supplied data. The risk mainly affects services that render documents from untrusted sources.
Recommendation
Upgrade pdfmake to version 0.3.12 or later. Additionally, consider validating and sanitizing user-supplied document definitions and SVG content.
Other vulnerabilities in pdfmake
See all- CVE-2026-26801High
A Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component.
- CVE-2025-11362High
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input.
Original NVD description (English source)
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS