jsPDF <=3.0.4 allowed arbitrary file write on the server via path traversal in the output filename
doc.save() without path sanitization — ../../etc/passwd writes outside the intended directorypath.resolve() validation in v4.0.0 ensures the resolved path stays within the intended output directorysaveFile function accepts a user-supplied filename and passes it directly to writeFile without any path sanitization. In Node.js environments (server-side PDF generation), a malicious actor can supply a filename like ../../app/config/evil.js to write files outside the intended output directory. This is a classic path traversal (CWE-22) vulnerability. The fix uses path.resolve() to compute the canonical path and checks it stays within the process working directory — any attempt to escape with ../ gets blocked.
doc.save() call looks like normal API usage. The vulnerability lives in the filename origin (user-supplied body parameter), not in the save call itself.req.body.filename passed to a file write is invisible if the reviewer doesn't model the request lifecycle... patterns but miss the context that the filename is user-controlled HTTP body data.doc.save(filename) call is safe in a client-side browser but dangerous in Node.js with user-supplied filenames.path.resolve() validation looks like overkill in the library itself; the security intent only makes sense when you know the call site involves user input.AI code review is most valuable when it catches the bugs that live between the lines — the ones that require understanding the call context, the deployment environment, and the trust boundaries. jsPDF is a client-side PDF library by design. But teams use it in Node.js servers for report generation. The same API call that is harmless in a browser becomes a path traversal when the filename comes from user input on a server.
PullLight models the execution context: it knows that a user-controlled HTTP body parameter flowing into a file write is a path traversal risk, regardless of whether the call looks like normal library usage. The CVSS 9.2 score is reserved for vulnerabilities that are both trivial to exploit and severe in impact — path traversal on a server is exactly that.
CVE-2025-68428 is a reminder that security isn't just about the code you write — it's about the context your code runs in. PullLight's multi-turn analysis catches this class of vulnerability because it reasons about the data flow, not just the syntax.
The
filenameparameter fromreq.body.filenameis passed directly todoc.save()without any path sanitization. A malicious actor can supply a value like../../app/config/evil.jsto write files outside the intended output directory. In server-side Node.js deployments, this can overwrite application files or inject malicious code, leading to remote code execution. This is a path traversal (CWE-22) vulnerability with a CVSS 9.2 rating.path.resolve()and validate the resolved path stays within the intended output directory. Reject or escape filenames containing..or absolute path components.