Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts. Details The vulnerability exists in packages/common/src/helper.ts:130-141. When getB64BasePdf receives a string that does not start with data:application/pdf;, and window is defined, it passes the string directly to fetch(): The Zod schema for basePdf in packages/common/src/schema.ts:133-135 accepts any string: The checkGenerateProps function at packages/common/src/helper.ts:279 only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or…
Recommended action: Upgrade to 5.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. Details 1. Sandbox Escape Leading to XSS The expression evaluator's sandbox can be bypassed to execute arbitrary JavaScript code. Attackers can obtain the Function constructor through indirect methods: Both payloads bypass the sandbox restrictions and execute Function("alert(location)")(). 2. Prototype Pollution The expression evaluator allows access to prototype accessor methods which can be exploited with Object.assign to pollute the prototype chain: - lookupGetter - lookupSetter - defineGetter - defineSetter Impact These vulnerabilities allow attackers to: - Execute arbitrary JavaScript code in the context of the application - Steal sensitive information including cookies and tokens - Modify application behavior through prototype pollution - Potentially perform actions on behalf of users Proof of Concept Loading…
Recommended action: Upgrade to 5.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.