PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

Description

The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g.

Recommendation

Update the @pdfme/common package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.5.9
• Patched version(s): 5.5.10

References

• GHSA-pgx6-7jcq-2qff
• CWE-918
• OWASP 2021-A10

Related Issues

• Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
• Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections - Vulnerability
• PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
• MCPHub has Path Traversal via Malicious MCPB Manifest Name - Vulnerability

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@pdfme/common