Description
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pdfme | common | < 5.5.10 | 5.5.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @pdfme/common | < 5.5.10 | 5.5.10 | GHSA-pgx6-7jcq-2qff |
References
- GitHub Security Advisory (GHSA-pgx6-7jcq-2qff) vendor-advisory
- VulnCheck Advisory: @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch third-party-advisory