Read the docs
TI-2026-21390 Aliases CVE-2026-26801GHSA-wp52-r2fp-4vmr

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through…

Priority MEDIUM 40CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pdfmake (npm): 0.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pdfmake (npm)0.3.0-beta.2 to before 0.3.60.3.6Patch availableGHSA-wp52-r2fp-4vmr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pdfmake (npm) Vendor— Affected 0.3.0-beta.2 to before 0.3.6 Fixed in 0.3.6 Patch available GHSA-wp52-r2fp-4vmr

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:pdfmake:pdfmake:*:*:*:*:*:*:*:*0.3.1 – 0.3.5VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:-:*:*:*:*:*:*0.3.0VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:*0.3.0 beta10VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:*0.3.0 beta11VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:*0.3.0 beta12VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:*0.3.0 beta13VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:*0.3.0 beta14VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:*0.3.0 beta15VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:*0.3.0 beta16VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta17:*:*:*:*:*:*0.3.0 beta17VulnerablePdfmake
  • cpe:2.3:a:pdfmake:pdfmake:*:*:*:*:*:*:*:* Versions 0.3.1 – 0.3.5 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:-:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:* Versions 0.3.0 beta10 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:* Versions 0.3.0 beta11 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:* Versions 0.3.0 beta12 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:* Versions 0.3.0 beta13 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:* Versions 0.3.0 beta14 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:* Versions 0.3.0 beta15 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:* Versions 0.3.0 beta16 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta17:*:*:*:*:*:* Versions 0.3.0 beta17 Vulnerable ·Pdfmake
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta18:*:*:*:*:*:*0.3.0 beta18VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta19:*:*:*:*:*:*0.3.0 beta19VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:*0.3.0 beta2VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:*0.3.0 beta3VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:*0.3.0 beta4VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:*0.3.0 beta5VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:*0.3.0 beta6VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:*0.3.0 beta7VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:*0.3.0 beta8VulnerablePdfmake
cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:*0.3.0 beta9VulnerablePdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta18:*:*:*:*:*:* Versions 0.3.0 beta18 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta19:*:*:*:*:*:* Versions 0.3.0 beta19 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:* Versions 0.3.0 beta2 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:* Versions 0.3.0 beta3 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:* Versions 0.3.0 beta4 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:* Versions 0.3.0 beta5 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:* Versions 0.3.0 beta6 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:* Versions 0.3.0 beta7 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:* Versions 0.3.0 beta8 Vulnerable ·Pdfmake
  • cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:* Versions 0.3.0 beta9 Vulnerable ·Pdfmake

Remediation

  • Fix · GHSA-wp52-r2fp-4vmr pdfmake (npm) Fixed in 0.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26801
  2. 2026-10-03 Alias added: GHSA-wp52-r2fp-4vmr
  3. 2026-10-25 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2022-22805 Code injection in pdfmake CVSS 3.1CRITICAL 10.0
  • TI-2025-10410 Resource allocation without limits in pdfmake CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences