CVE-2026-82866

@pdfme/common versions before 5.5.10 are vulnerable to server-side request forgery (SSRF, CWE-918) in the getB64BasePdf function, which fetches the PDF referenced by the basePdf field without validating the destination URL. When an attacker can control the basePdf value in a template — for example in an application that renders user-supplied pdfme templates — the server or client performing PDF generation is forced to make arbitrary requests, including to internal network endpoints. Successful exploitation enables internal metadata exfiltration, network reconnaissance, and blind request forgery, though per the CVSS 4.0 score of 8.9 (High) it does not directly alter or disrupt the vulnerable system. Any application or service using @pdfme/common before 5.5.10 that lets untrusted users supply or influence basePdf is affected, while deployments where templates are entirely developer-defined are less exposed given the flaw's conditional exploitation requirements. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates only about a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade @pdfme/common to 5.5.10 or later, including when it is pulled as a transitive dependency of other pdfme packages — audit lockfiles and rebuild after updating. Check whether your application renders templates with attacker-influenced basePdf values, and mitigate by restricting basePdf to an allowlist of trusted hosts or pre-validated PDF sources, blocking requests to internal and cloud metadata endpoints. No public proof-of-concept or in-the-wild exploitation is currently known.