The vulnerability in pdfmake allows an attacker to supply a document definition that contains an SVG image with an href pointing to a local file. The bug is that the library ignores the security restriction set by setLocalAccessPolicy, so the referenced local file can be read and embedded within the generated PDF. This results in the accidental disclosure of files that should have been protected, exposing sensitive data such as configuration files or user credentials. The flaw is a classic local file path traversal bypass (CWE-73) and is considered a moderate severity issue because it depends on the attacker’s ability to supply or influence the document definition.

The affected package is pdfmake by bpampuch. Versions 0.3.8 up to and including 0.3.11 are vulnerable. A patch was released in version 0.3.12, which correctly enforces the local access policy for SVG images.

The CVSS score of 6.9 reflects the potential for confidentiality compromise with moderate attack complexity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploits are not yet documented. However, the attack vector requires an attacker to supply or modify a document definition that is processed by pdfmake, typically within web applications or document generation services. If an application accepts such definitions from untrusted sources, an attacker can read local files that should otherwise be unreachable. The overall risk is moderate, but organizations should consider the likelihood of compromised user input or insecure integration.