What’s Vulnerable › Vulnerabilities

CVE-2026-114491: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-28
• Weakness: CWE-73

Description

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

Affected products

• bpampuch pdfmake: from 0.3.8 before 0.3.12 — fixed in 0.3.12

How to fix

Upgrade to a fixed version: bpampuch pdfmake 0.3.12. Check the vendor advisory for mitigations.

References

• https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372
• https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
• https://github.com/bpampuch/pdfmake/releases/tag/0.3.12
• https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images

Get alerted when CVE-2026-114491 or the next vulnerability affects your stack