@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation

Description

The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.

Recommendation

Update the @pdfme/common package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.4.1
• Patched version(s): 5.4.1

References

• GHSA-54xv-94qv-2gfg
• CVE-2025-53626
• CWE-1321
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Elysia vulnerable to prototype pollution with multiple standalone schema validation - CVE-2025-66456
• parse is vulnerable to prototype pollution - CVE-2025-57324
• Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
• mpregular vulnerable to prototype pollution - CVE-2025-57323

Tags:

npm

@pdfme/common