Skip to content
OpenAdvisories

Product · pdfme

common

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-115729

    @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

    @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alia…

    pdfme common
  • Medium 6.8
    CVE-2026-82866

    @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

    @pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force serve…

    pdfme common @pdfme/common npm