@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation

Description

The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.

Recommendation

Update the @pdfme/common package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.4.1
• Patched version(s): 5.4.1

References

• GHSA-54xv-94qv-2gfg
• CVE-2025-53626
• CWE-1321
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements - CVE-2025-12758
• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150
• @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability
• Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability

Tags:

npm

@pdfme/common