CVE-2026-82866

Name of the Vulnerable Software and Affected Versions @pdfme/common versions prior to 5.5.10

Description An issue exists in the getB64BasePdf() function where it fetches arbitrary URLs using fetch() without proper validation when the basePdf variable is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template can force the server or client to make requests to arbitrary internal or external endpoints. This can lead to Server-Side Request Forgery (SSRF) in server-side rendering contexts or blind request forgery in browser contexts. Potential impacts include the exfiltration of cloud metadata (such as IAM credentials and API tokens from endpoints like 169.254.169.254), internal network reconnaissance to map topology and discover open ports, and unauthorized access to internal APIs, databases, or admin panels.

Recommendations Update @pdfme/common to version 5.5.10 or later. As a temporary workaround, restrict or validate the basePdf input to ensure it does not point to private or reserved IP ranges and uses only approved protocols (HTTP/HTTPS) before it is processed by the getB64BasePdf() function.