Threat database

CVE-2026-115729 is a server-side request forgery (SSRF) vulnerability in the pdfme common library versions from 5.5.10 up to but not including 6.2.6. The flaw allows attackers to bypass the isUrlSafeToFetch denylist in the getB64BasePdf function by using specially crafted basePdf URLs with IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. This enables reading of loopback, internal, or cloud metadata responses through generated PDF documents.

CVE-2026-82868 is a cross-site scripting (XSS) vulnerability in the @pdfme/schemas package before version 5.5.9. The flaw exists in the SVG schema plugin, which renders user-supplied SVG content directly into innerHTML without proper sanitization. This allows attackers to inject malicious SVG elements containing scripts or event handlers that execute arbitrary JavaScript in users' browsers when they view or fill templates.

A cross-site scripting (XSS) vulnerability exists in the Select schema plugin of @pdfme/schemas versions before 5.5.9. The vulnerability arises from improper sanitization of option values before inserting them into HTML using innerHTML, allowing attackers to execute arbitrary JavaScript in users' browsers via crafted templates.

A Server-Side Request Forgery (SSRF) vulnerability exists in @pdfme/common versions before 5.5.10 in the getB64BasePdf function. This function fetches arbitrary URLs without validation when the basePdf template field is attacker-controlled. Exploitation allows attackers to make unauthorized requests to internal endpoints, potentially leading to metadata exfiltration and network reconnaissance.

pdfme schemas versions before 5.5.10 contain a low-severity cross-site scripting (XSS) vulnerability in the multiVariableText property panel. This flaw arises because unsanitized internationalization (i18n) label values are assigned directly to innerHTML, allowing attackers who can control label overrides via options.labels to inject arbitrary JavaScript. The malicious script executes when users open the Designer and select a multiVariableText field without variable placeholders.

pdfme pdf-lib versions before 5.5.10 have a vulnerability in the DecodeStream.ensureBuffer() method that allows denial of service via a decompression bomb in a FlateDecode stream. An attacker can upload a crafted PDF that decompresses to a very large size, exhausting memory and causing crashes or freezes during PDF parsing.