CVE-2026-115729GHSA-2rg9-wxfw-wrr7GHSA-pgx6-7jcq-2qff
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
pdfme common
CVSS
8.9HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 6.2.6commonCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
Text from CVE List
Affected versions 1
- commonaffected: 5.5.10 before 6.2.6CVE List
References 4
- github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6Fixvia CVE List
- github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7Advisoryvia CVE List
- github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qffAdvisoryvia CVE List
- vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypassAdvisoryvia CVE List