Server-side Request Forgery (SSRF) Affecting @pdfme/common package, versions <5.5.10
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-PDFMECOMMON-15746945
- published22 Mar 2026
- disclosed20 Mar 2026
- creditrestriction
Introduced: 20 Mar 2026
CVE NOT AVAILABLE CWE-918 (opens in a new tab)How to fix?
Upgrade @pdfme/common to version 5.5.10 or higher.
Overview
@pdfme/common is a TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the getB64BasePdf function when unvalidated URLs are fetched if the basePdf parameter is attacker-controlled. An attacker can access internal or external network resources and potentially exfiltrate sensitive data by supplying a crafted URL, leading the server or client to make unauthorized requests.