CVE-2026-114491: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

Published Oct 21, 2026

Updated

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

Affected Software

0 affected components

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pdfmake to a version that resolves this vulnerability.
Fixed in 0.3.12

Event History

Oct 21, 2026

CVE Published

via MITRE·05:54 PM

Data Sourced

via MITRE·05:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using pdfmake versions 0.3.8 through 0.3.11 are exposed if they generate PDFs from document definitions that an attacker can supply or influence and use setLocalAccessPolicy() to restrict local-file access.

What does an attacker need to exploit it?

An attacker needs the ability to provide a document definition containing SVG content. They can reference a local path through an SVG image href, causing the referenced file's contents to be embedded in the generated PDF.

Are applications protected by setLocalAccessPolicy() affected?

Yes. The restriction is not applied to images referenced from inside SVG content, so it does not prevent this SVG-based local-file read path in affected versions.

What version addresses the issue?

The issue is fixed in pdfmake 0.3.12. Versions before 0.3.12 in the affected 0.3.x range should be upgraded.