pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

Summary

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

Evidence

Reported to the maintainer with a proof of concept that reproduced against the affected release.

Remediation

Upgrade pdfmake to 0.3.12 or later.

References

• VulnCheck advisoryhttps://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images
• Fix commithttps://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
• Vulnerable codehttps://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372
• CVE recordhttps://www.cve.org/CVERecord?id=CVE-2026-114491