CVE-2025-53626
CVE-2025-53626 · pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.
CVSS 6.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
pdfme
- Versions
- >= 5.2.0, < 5.4.1: Affected
No fix published
@pdfme/common npm
- Affected ranges
- SEMVER: ≥ 5.2.0, < 5.4.1
Update to 5.4.1