PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

Description

The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g.

Recommendation

Update the @pdfme/common package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.5.9
• Patched version(s): 5.5.10

References

• GHSA-pgx6-7jcq-2qff
• CWE-918
• OWASP 2021-A10

Related Issues

• PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
• Astro has Full-Read SSRF in error rendering via Host: header injection - CVE-2026-25545
• @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581

Tags:

npm

@pdfme/common