Critical jsPDF flaw lets hackers steal secrets via generated PDFs

A critical path traversal/local file inclusion vulnerability (CVE-2025-68428, CVSS 9.2) in jsPDF versions before 4.0 allows attacker-controlled paths to be read via the loadFile function in Node.js builds (dist/jspdf.node.js and dist/jspdf.node.min.js), letting local files be embedded into generated PDFs; addImage, html, and addFont can also trigger the flaw. The widely used library (≈3.5 million weekly npm downloads) was patched in jsPDF v4.0.0 by restricting filesystem access and relying on Node.js permission mode; Endor Labs recommends Node 22.13.0/23.5.0/24.0.0+ and warns that using the global --permission flag or overly broad --allow-fs-read negates the fix. Firms running server-side jsPDF should urgently upgrade or enforce path sanitization/allowlists, as broad deployment makes active exploitation plausible.

Analysis

Market structure: This vuln (CVE-2025-68428, 9.2) increases demand for application-security, SCA, and runtime protection, directly benefiting public leaders such as Palo Alto Networks (PANW), CrowdStrike (CRWD), Fortinet (FTNT), Synopsys (SNPS) and the HACK ETF (HACK). Small/mid-cap web-native SaaS firms that rely on Node.js builds and large numbers of npm dependencies are the immediate losers; expect a reallocation of 3–8% of 2026 security budgets toward app-security tooling over 6–12 months.

Risk assessment: Tail risks include a high-impact breach that triggers GDPR fines (up to 4% revenue) or class-action suits for exposed customer data; such an event could widen credit spreads for vulnerable SMB SaaS names by 150–300bp in 30–90 days. Immediate window (days–weeks): emergency patches and version migrations; short-term (1–3 months): exploit PoCs and incident reports; long-term (3–12 months): increased vendor selection and cloud migration to managed services if Node permission model proves disruptive.

Trade implications: Favor long exposure to cybersecurity defensives and SCA specialists (HACK, PANW, SNPS) while trimming high-risk small/mid-cap SaaS by 1–3% and hedging software-beta with short-dated puts on broad software ETFs (IGV 3-month ATM puts sized 0.5% portfolio). Use 3-month call spreads (buy 15–25% OTM, sell 35–45% OTM) on PANW and SNPS to gain asymmetric upside if budgets re-accelerate; scale into positions over 48–72 hours as PoC/exploit cadence becomes clear.

Contrarian angles: The market may overpay for security wins immediately; remember Log4Shell (2021) drove a 6–12 month revenue bump but strong mean reversion thereafter — cap position sizes to 2–3% per name. Unintended consequence: if firms enable broad Node "--allow-fs-read" workarounds, the vulnerability persists and demand disperses to peripheral tooling rather than core firewall/EDR vendors, so monitor configuration telemetry and PoC counts (threshold >5 public PoCs in 30 days) before adding aggressively.

Key Decisions for Investors

• Establish a 3% portfolio long position in the HACK ETF (HACK) over 3–12 months to capture secular reallocation to cybersecurity; add an incremental 1% if public exploit PoCs exceed 5 within 30 days.
• Build a 2.5% combined long position: 1.5% in Palo Alto Networks (PANW) and 1.0% in Synopsys (SNPS); complement with 3-month call spreads (buy 15% OTM / sell 35% OTM) sized to 1% portfolio each to limit cash outlay while targeting a 2–4x payoff if budgets accelerate.
• Reduce exposure to small/mid-cap web-native SaaS names by 1–3% (identify candidates with >30% Node.js backend exposure via product disclosures) and buy 3-month ATM puts on IGV sized 0.5% portfolio as a short-term hedge against reputational/MCAP downside.
• Trigger-based add: if within 30 days there are >5 distinct PoC exploit disclosures or a public breach tied to jsPDF/npm, increase cyber longs (HACK/PANW/SNPS) by +1–2% and rotate 50% of added allocation into managed cloud providers (AMZN, MSFT, GOOGL) over the next 60 days.