Skip to content
OpenAdvisories

Package · npm

@pdfme/common

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.8
    CVE-2026-82866

    @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

    @pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force serve…

    pdfme common @pdfme/common npm
  • Medium 6.1
    CVE-2025-53626

    pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation

    pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.…

    pdfme pdfme @pdfme/common npm