CRITICAL JSPDF FLAWS LETS HACKERS STEAL SECRETS VIA GENERATED PDFS

Summary from the TLDR InfoSec newsletter

The popular jsPDF library is vulnerable to a local file inclusion and path traversal attack that can allow attackers to steal secrets. The flaw allows attackers to pass unsanitized paths directly to the loadFile function or any functions that call it. The vulnerability was fixed in version 4.0.0, but it may not be comprehensive on Node 20 and earlier.