EUVD-2026-68401
GHSA-4jj6-4ggm-xjcj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via template submission with no auth required; AC:H for SSR window-polyfill prerequisite; S:C and C:H for unrestricted internal endpoint access including IMDS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5Blast Radius
ecosystem impact- 15 npm packages depend on @pdfme/common (10 direct, 5 indirect)
Ecosystem-wide dependent count for version 5.5.10.
DescriptionCVE.org
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
AnalysisAI
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: first, the attacker must be able to supply or influence the basePdf field of a pdfme template - this applies to any web application that accepts user-provided templates or exposes template customization without sanitizing the basePdf property. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.9 with AC:H and AT:P reflects genuine complexity requirements: exploitation requires both attacker control over the basePdf template field and an SSR execution context where window is defined and polyfilled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @pdfme/common to version 5.5.10 or later, which is the vendor-released patch per GHSA-pgx6-7jcq-2qff. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. Rated high severity
XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. Rated critical severity (CVSS 9.8), this vulnerability is rem
Alpine Linux: buildah fixed in 1.37.4-r0
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. Rated high severit
Common is a package of common modules that can be accessed by NIMBLE services. Rated medium severity (CVSS 6.5), this vu
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today