Description
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
mariopepe/CVE-2026-26801-pdfmake-ssrf ★ 0 · Mar 18, 2026
PoC for CVE-2026-26801: SSRF in pdfmake URLResolver.js (>= 0.3.0-beta.2, <= 0.3.5)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pdfmake | >= 0.3.0-beta.2, < 0.3.6 | 0.3.6 | GHSA-wp52-r2fp-4vmr |