[2026-01-07_18:27:58] Starting reproduction for GHSA-f8cm-6447-x5h2 [2026-01-07_18:27:58] Node present: v22.21.1, npm: 10.9.4 [2026-01-07_18:27:58] Prepared secret at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/secret.txt with token: JS_PDF_LFI_SECRET_TOKEN=1767810478_12586 [2026-01-07_18:28:00] Latest jspdf on npm: 4.0.0 (patched baseline >= 4.0.0) [2026-01-07_18:28:00] Installing jspdf@3.0.4 in /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln up to date, audited 24 packages in 2s 1 package is looking for funding run `npm fund` for details 1 critical severity vulnerability To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. [2026-01-07_18:28:02] jspdf installed in /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln: 3.0.4 [2026-01-07_18:28:02] Executing addImage PoC (vuln) -> /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/out_addImage.pdf PoC addImage completed [2026-01-07_18:28:02] Executing addFont PoC (vuln) -> /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/out_addFont.pdf jsPDF PubSub Error Invalid character DOMException [InvalidCharacterError]: Invalid character at atob (node:buffer:1302:13) at addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:26593:39) at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:26626:9) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:888:18) at Object.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:3267:12) at API.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:5779:20) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/poc_addfont.js:10:9 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/poc_addfont.js:20:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) jsPDF PubSub Error Cannot read properties of undefined (reading 'widths') TypeError: Cannot read properties of undefined (reading 'widths') at jsPDFAPI.pdfEscape16 (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:27345:40) at utf8TextFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:27641:16) at Object.utf8EscapeFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:27682:15) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:888:18) at API.__private__.text.API.text (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/node_modules/jspdf/dist/jspdf.node.js:4764:12) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/poc_addfont.js:12:9 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/poc_addfont.js:20:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) PoC addFont completed [2026-01-07_18:28:03] [HIT] Secret token found in vulnerable:addImage PDF: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/out_addImage.pdf [2026-01-07_18:28:03] [MISS] Secret token NOT found in vulnerable:addFont PDF: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/vuln/out_addFont.pdf [2026-01-07_18:28:03] Vulnerable version reproduction: SUCCESS (token found) [2026-01-07_18:28:03] Installing jspdf@4.0.0 in /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched up to date, audited 24 packages in 2s 1 package is looking for funding run `npm fund` for details found 0 vulnerabilities [2026-01-07_18:28:05] jspdf installed in /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched: 4.0.0 [2026-01-07_18:28:05] Executing addImage PoC (patched) -> /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/out_addImage.pdf PoC addImage error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/poc_addimage.js:11:9 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/poc_addimage.js:20:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:05] [WARN] PDF not found for patched:addImage: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/out_addImage.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_1.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_1.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:05] [WARN] PDF not found for patched:addImage_rel: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/1_addImage_rel.pdf [2026-01-07_18:28:05] attempt:addImage_rel result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/1_addImage_rel.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_2.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_2.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:05] [WARN] PDF not found for patched:addImage_abs: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/2_addImage_abs.pdf [2026-01-07_18:28:06] attempt:addImage_abs result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/2_addImage_abs.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_3.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_3.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:06] [WARN] PDF not found for patched:addImage_png: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/3_addImage_png.pdf [2026-01-07_18:28:06] attempt:addImage_png result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/3_addImage_png.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_4.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_4.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:06] [WARN] PDF not found for patched:addImage_file_scheme: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/4_addImage_file_scheme.pdf [2026-01-07_18:28:06] attempt:addImage_file_scheme result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/4_addImage_file_scheme.pdf jsPDF PubSub Error Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:26688:27) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:888:18) at Object.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:3267:12) at API.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:5779:20) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_5.js:18:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_5.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) jsPDF PubSub Error Cannot read properties of undefined (reading 'widths') TypeError: Cannot read properties of undefined (reading 'widths') at jsPDFAPI.pdfEscape16 (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27418:40) at utf8TextFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27714:16) at Object.utf8EscapeFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27755:15) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:888:18) at API.__private__.text.API.text (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:4764:12) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_5.js:20:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_5.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) Saved /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/5_addFont_rel.pdf [2026-01-07_18:28:06] [MISS] Secret token NOT found in patched:addFont_rel PDF: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/5_addFont_rel.pdf [2026-01-07_18:28:06] attempt:addFont_rel result=MISSING file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/5_addFont_rel.pdf jsPDF PubSub Error Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:26688:27) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:888:18) at Object.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:3267:12) at API.addFont (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:5779:20) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_6.js:18:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_6.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) jsPDF PubSub Error Cannot read properties of undefined (reading 'widths') TypeError: Cannot read properties of undefined (reading 'widths') at jsPDFAPI.pdfEscape16 (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27418:40) at utf8TextFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27714:16) at Object.utf8EscapeFunction (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:27755:15) at PubSub.publish (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:888:18) at API.__private__.text.API.text (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:4764:12) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_6.js:20:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_6.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) Saved /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/6_addFont_abs.pdf [2026-01-07_18:28:06] [MISS] Secret token NOT found in patched:addFont_abs PDF: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/6_addFont_abs.pdf [2026-01-07_18:28:06] attempt:addFont_abs result=MISSING file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/6_addFont_abs.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_7.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_7.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:07] [WARN] PDF not found for patched:addImage_traversal: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/7_addImage_traversal.pdf [2026-01-07_18:28:07] attempt:addImage_traversal result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/7_addImage_traversal.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_8.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_8.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:07] [WARN] PDF not found for patched:addImage_longpath: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/8_addImage_longpath.pdf [2026-01-07_18:28:07] attempt:addImage_longpath result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/8_addImage_longpath.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.nodeReadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15958:13) at jsPDFAPI.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:15905:25) at Object.processImageData (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10913:33) at jsPDFAPI.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:10887:34) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_9.js:33:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_9.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:07] [WARN] PDF not found for patched:loadFile_direct: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/9_loadFile_direct.pdf [2026-01-07_18:28:07] attempt:loadFile_direct result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/9_loadFile_direct.pdf Attempt error: Error: Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property. at Object.e (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.min.js:268:135) at t.loadFile (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.min.js:268:991) at Object._ (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.min.js:115:7929) at t.addImage (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.min.js:115:7754) at /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_10.js:50:11 at Object. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/patch_attempt_10.js:59:3) at Module._compile (node:internal/modules/cjs/loader:1706:14) at Object..js (node:internal/modules/cjs/loader:1839:10) at Module.load (node:internal/modules/cjs/loader:1441:32) at Function._load (node:internal/modules/cjs/loader:1263:12) [2026-01-07_18:28:07] [WARN] PDF not found for patched:addImage_browser_require: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/10_addImage_browser_require.pdf [2026-01-07_18:28:07] attempt:addImage_browser_require result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/10_addImage_browser_require.pdf /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:16133 var el = document.createElement(tagName); ^ ReferenceError: document is not defined at createElement (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:16133:14) at Promise. (/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/node_modules/jspdf/dist/jspdf.node.js:16267:20) Node.js v22.21.1 [2026-01-07_18:28:07] [WARN] PDF not found for patched:html_rel: /root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/11_html_rel.pdf [2026-01-07_18:28:07] attempt:html_rel result=NOT_FOUND file=/root/.pruva/runs/ghsa-f8cm-6447-x5h2_20260107-182243/bundle/repro_work/patched/attempts/11_html_rel.pdf [2026-01-07_18:28:07] Reproduction result: SUCCESS (vulnerable works; patched blocks including bypass suite)