@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation

Description

The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.

Recommendation

Update the @pdfme/common package to the latest compatible version. Followings are version details:

Affected version(s): >= 5.2.0, < 5.4.1
Patched version(s): 5.4.1

References

GHSA-54xv-94qv-2gfg
CVE-2025-53626
CWE-1321
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation and gives you actionable findings to investigate.

Start a free scan

Related Issues

counterpart vulnerable to prototype pollution - CVE-2025-57354
query-parser-string is vulnerable to Prototype Pollution - CVE-2025-63704
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name - CVE-2023-26920
dref is vulnerable to prototype pollution - CVE-2025-26278

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated July 10, 2025