Read the docs

pdfme

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

pdfme records in CISA KEV

No pdfme vulnerabilities are listed in CISA KEV.

Records

7 records

TI-2026-79748 CVE-2026-115729 · GHSA-wf6h-pqhw-phmv

Server-side request forgery in @pdfme/common denylist bypass

Priority HIGH 72

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00443 Published 2026-10-23 Fixed in 6.2.6 CWE-918
TI-2026-57170 CVE-2026-82866 · GHSA-4jj6-4ggm-xjcj

@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

Priority HIGH 72

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00347 Published 2026-08-31 Fixed in 5.5.10 CWE-918
TI-2026-57172 CVE-2026-82868 · GHSA-9f44-gwhq-mr2g

@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

Priority MEDIUM 57

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2026-08-31 Fixed in 5.5.9 CWE-79
TI-2026-57171 CVE-2026-82867 · GHSA-q78q-xrxw-xgx6

@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

Priority MEDIUM 57

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0031 Published 2026-08-31 Fixed in 5.5.9 CWE-79
TI-2026-57169 CVE-2026-82865 · GHSA-v7hf-w8f6-4v98

pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

Priority MEDIUM 44

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00203 Published 2026-08-31 Fixed in 5.5.10 CWE-79
TI-2026-57168 CVE-2026-82864 · GHSA-gvgq-37w5-4f8q

pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

Priority LOW 32

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDeco…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-08-31 Fixed in 5.5.10 CWE-409
Open these records in search →