Live › vulnerability › CVE-2026-114491
Go to dashboardpdfmake 0.3.8 before 0.3.12 does not apply the setLocalAccessPolicy() restriction to images referenced inside SVG content. An attacker who supplies a document definition can point an SVG image href at a blocked local path and get that file's contents embedded in the generated PDF.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that run pdfmake versions from 0.3.8 up to but not including 0.3.12 and that accept document definitions from users or other untrusted sources. The risk depends on the server holding sensitive local files that the access policy was meant to block. Teams that only generate PDFs from trusted, fixed templates, or that do not use SVG images, are much less exposed.
No product ranges from the sources yet.
npm ls pdfmake in the project that renders PDFs.setLocalAccessPolicy in the code to see whether a local access policy is configured at all.grep -rn "svg" src/ near pdfmake calls.0.3.12 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
This page as .md · .json · in your agent: get_signal("CVE-2026-114491")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.