CVE-2025-53626

—

CVSS 3.1

6.1 medium

EPSS

<1%p21

Published

Jul 10, 2025 (Jul 10, 2025)

Modified

Jun 17, 2026

Description

pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.

Weakness: CWE-79, CWE-94, CWE-1321
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.