🚨 jsPDF Bulk Detector – CVE-2025-68428 🚨

Asset-wide detection tool for identifying jsPDF usage related to CVE-2025-68428. Detection only — no exploitation.

🚨 Background

A critical vulnerability was disclosed in the popular JavaScript PDF generation library jsPDF, tracked as CVE-2025-68428.

According to reporting by BleepingComputer, this flaw allows attackers to read arbitrary local files when jsPDF is used in Node.js environments and user-controlled input reaches file-loading functions.

Vulnerability Details:

Type: Local File Inclusion (LFI) + Path Traversal

Severity: 9.2 (Critical)

Affected Versions: jsPDF < 4.0.0

Scope: Node.js builds only (jspdf.node.js)

Given jsPDF’s massive adoption (~3.5M weekly npm downloads), identifying affected assets at scale is critical during security assessments.

🎯 Purpose of This Tool

This tool helps security researchers, pentesters, and AppSec teams to:

Identify jsPDF usage across multiple web assets

Extract version information when exposed

Support component discovery & attack surface mapping

Prioritize manual validation for CVE-2025-68428

⚠️ This tool does NOT exploit the vulnerability. It is intended strictly for authorized security testing.

🧠 What This Tool Detects

The script checks for jsPDF usage using multiple techniques:

HTML source inspection

Linked JavaScript file analysis

Commonly exposed package.json locations

Regex-based jsPDF fingerprinting

Best-effort version extraction

🛠️ How It Works

Reads a list of domains from a file

Fetches HTML content

Extracts linked JavaScript files

Searches for jsPDF indicators

Attempts version identification

Outputs detected assets for manual review

📦 Installation git clone https://github.com/Nurjaman2004/jsPDF-Bulk-Detector-CVE-2025-68428-.git cd jsPDF-Bulk-Detector-CVE-2025-68428- pip3 install requests

Requirements

Python 3.x

requests

🚀 Usage 1️⃣ Prepare a target list

Create a file named domains.txt:

example.com testsite.org https://demo.example.net

2️⃣ Run the scanner python3 jspdf_bulk_detector.py domains.txt

3️⃣ Sample Output

jsPDF Bulk Detection Tool CVE-2025-68428 | Asset-Wide Scan

[*] Scanning: https://example.com [+] https://example.com --> jsPDF detected (v3.5.2)

[*] Scanning: https://safe-site.com [✓] No jsPDF components detected across provided assets

🧪 Interpreting Results Result Meaning jsPDF detected Component present Version < 4.0.0 Potentially affected Version unknown Manual validation required No detection jsPDF not found

⚠️ Detection ≠ Vulnerability Only Node.js implementations with unsafe file path handling are exploitable.

🔍 Next Steps After Detection

If jsPDF is detected:

Verify whether PDF generation occurs server-side

Identify endpoints such as:

/generate-pdf

/export

/invoice

Trace user input reaching:

loadFile

addImage

addFont

html()

Confirm Node.js runtime and jsPDF version

🔐 Defensive Recommendations

Upgrade to jsPDF v4.0.0+

Never pass user-controlled file paths

Use strict allowlists

Avoid overly permissive Node.js filesystem flags

⚖️ Legal & Ethical Disclaimer

This tool is intended for educational purposes and authorized security testing only. The author is not responsible for misuse or illegal activity.

📚 References

CVE-2025-68428

jsPDF Security Advisory

Endor Labs Technical Analysis

BleepingComputer report on jsPDF vulnerability

Author Nurjaman Shaikh Cybersecurity Researcher | VAPT Analyst