pdfmake CVE-2026-114491

Exploitation requires that (1) the host application generates PDFs from attacker-controllable pdfmake document definitions, and (2) the application relies on setLocalAccessPolicy() to restrict local file access - this flaw is specifically a bypass of that restriction for images referenced via href inside SVG content. The attacker must be able to place an SVG element with a local-path image href into the document definition. Limiting factors: if setLocalAccessPolicy() is not used (no restriction expected) or document definitions are fully trusted/operator-controlled, there is no exposure; impact is confined to confidentiality (reading files the pdfmake process can access) with no integrity or availability effect, and only affects pdfmake 0.3.8 through 0.3.11 (fixed in 0.3.12).

This is a moderate, condition-dependent information-disclosure flaw rather than a top-tier priority. The only authoritative scoring signal provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) describing network, low-complexity, unauthenticated access with only LOW confidentiality impact and no integrity or availability impact - consistent with CWE-73 (external control of file name or path) and the description of a local-file read bypass. No EPSS score, no CISA KEV listing, and no explicit POC indicator were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding comes from VulnCheck research plus a confirmed vendor patch. The PR:N / AV:N metrics are only realistic for applications that expose pdfmake to attacker-controlled document definitions AND rely on setLocalAccessPolicy() as a security boundary - absent that specific configuration there is no meaningful exposure, which tempers the network-unauthenticated framing. Net: a real but narrow server-side SSRF-like file-disclosure bug affecting a popular library, worth patching promptly where document definitions are user-supplied, but not an emergency given LOW impact, no KEV, and no known exploitation.

An application lets untrusted users submit pdfmake document definitions and uses setLocalAccessPolicy() to block local file access as a security control. An attacker submits a definition containing an SVG image whose href points to a sensitive local path (e.g. a config or key file); because the restriction is not applied to images inside SVG content, the file's contents are embedded into the generated PDF and returned to the attacker. No public exploit code was identified in the provided data, though the mechanism is straightforward to reproduce from the description.