Description (CNA)
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pdfme / common | affected 0 before 5.5.10; unaffected 5.5.10 |
CWE
CWE-918
References
- https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff
- https://www.vulncheck.com/advisories/pdfme-common-before-5.5.10-ssrf-via-unvalidated-url-fetch
ADP enrichment
No English description supplied.