[GH-ISSUE #830] vulnerability in note-gen project #619

New issue

Closed

opened 2026-03-02 03:40:53 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 03:40:53 +03:00

Owner

Originally created by @ankitdn on GitHub (Jan 6, 2026).
Original GitHub issue: https://github.com/codexu/note-gen/issues/830

While working in note-gen project, I identified this vulnerability during a review of how external resources were loaded into PDFs. While testing user-supplied inputs for PDF generation, I noticed that the loadFile method accepts file paths directly without sufficient validation.

CVE Link
CVE Report

Originally created by @ankitdn on GitHub (Jan 6, 2026). Original GitHub issue: https://github.com/codexu/note-gen/issues/830 While working in note-gen project, I identified this vulnerability during a review of how external resources were loaded into PDFs. While testing user-supplied inputs for PDF generation, I noticed that the loadFile method accepts file paths directly without sufficient validation. [CVE Link](https://vulert.com/vuln-db/jspdf-has-local-file-inclusion-path-traversal-vulnerability) [CVE Report](https://vulert.com/vuln-scan/list/ec62a5ad-daa6-4c46-b40d-f70a2a8a8906)