Description
The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g.
Recommendation
Update the @pdfme/common package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.5.9
- Patched version(s): 5.5.10
References
Could your website be exposed too?
SmartScanner can check your website for PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
- Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections - Vulnerability
- PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
- MCPHub has Path Traversal via Malicious MCPB Manifest Name - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026