pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files.
CVSS 4.0MEDIUM 6.9·Network·No auth·No interaction·EPSS 0.00255·Published 2026-10-21·Fixed in 0.3.12CWE-73