CVE-2026-82866
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
- Published Aug 31, 2026
- CVSS 8.9 high
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available