Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck
CVE-2026-114491pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
Medium 5.3
In plain English
A medium-severity security flaw in pdfmake from bpampuch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 82.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd patch
- pdfmake 0.3.12 Release Notes release-notes
- https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372 technical-description
- VulnCheck Advisory: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images third-party-advisory