{"id":"CVE-2026-114491","summary":"pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images","details":"pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.","modified":"2026-10-22T02:48:52.347639657Z","published":"2026-10-21T17:54:16.217Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114491.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"0.3.8"},{"fixed":"0.3.12"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"introduced":"0.3.8"},{"fixed":"0.3.12"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"range":[{"introduced":"0.3.8"},{"fixed":"0.3.12"}],"source":"DESCRIPTION"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114491.json"},{"type":"PACKAGE","url":"https://github.com/bpampuch/pdfmake"},{"type":"ARTICLE","url":"https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372"},{"type":"FIX","url":"https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd"},{"type":"ADVISORY","url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.12"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114491"},{"type":"WEB","url":"https://www.npmjs.com"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bpampuch/pdfmake","events":[{"introduced":"0"},{"fixed":"4ad4cbf2713568304dd4cbc3090bfb912a78dfdd"},{"fixed":"9c634c52e994faafb5dde11b719e804deedeaf98"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"4ad4cbf2713568304dd4cbc3090bfb912a78dfdd"}],"source":"REFERENCES_COMMIT"},{"original_tag":"0.3.12","range":[{"fixed":"9c634c52e994faafb5dde11b719e804deedeaf98"}],"source":"REFERENCES_TAG"}]}}],"versions":["0.3.11","0.3.10","0.3.9","0.3.8","0.3.7","0.3.6","0.3.5","0.3.4","0.3.3","0.3.2","0.3.1","0.3.0","0.3.0-beta.19","0.3.0-beta.18","0.3.0-beta.17","0.3.0-beta.16","0.3.0-beta.15","0.3.0-beta.14","0.3.0-beta.13","0.3.0-beta.12","0.3.0-beta.11","0.3.0-beta.10","0.3.0-beta.9","0.3.0-beta.8","0.3.0-beta.7","0.3.0-beta.6","0.3.0-beta.5","0.3.0-beta.4","0.3.0-beta.3","0.3.0-beta.2","0.3.0-beta.1","0.1.40","0.1.39","0.1.38","0.1.37","0.1.36","0.1.35","0.1.34","0.1.33","0.1.32","0.1.31","0.1.30","0.1.29","0.1.28","0.1.27","0.1.26","0.1.25","0.1.24","0.1.23","0.1.22","0.1.20","0.1.18","0.1.17","0.1.15","0.1.13","0.1.12","0.1.11","0.1.10","0.1.8","0.1.7","0.1.6","0.1.3","0.1.2","0.1.1","0.1.0","0.0.13","0.0.12","0.0.11","0.0.10","0.0.9","0.0.8","0.0.7","0.0.6","0.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114491.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}