{"items":[{"id":"NVI-00015421","kind":"vulnerability","title":"PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pgx6-7jcq-2qff","CVE-2026-82866"],"plain_summary":"OSV carries this publisher advisory for @pdfme/common. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.5.10 for @pdfme/common. Confirm the publisher’s latest guidance.","source_ids":["sr-a037f4058787dbf42da44f87ad06bddd"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a037f4058787dbf42da44f87ad06bddd","url":"https://github.com/advisories/GHSA-pgx6-7jcq-2qff","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-pgx6-7jcq-2qff","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-03T22:35:22.946Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a037f4058787dbf42da44f87ad06bddd"],"technology":"@pdfme/common","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `getB64BasePdf` function in `@pdfme/common` fetches arbitrary URLs via `fetch()` without any validation when `basePdf` is a non-data-URI string and `window` is defined. An attacker who can control the `basePdf` field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts.\n\n## Details\n\nThe vulnerability exists in `packages/common/src/helper.ts:130-141`. When `getB64BasePdf` receives a string that does not start with `data:application/pdf;`, and `window` is defined, it passes the string directly to `fetch()`:\n\n```typescript\n// packages/common/src/helper.ts:130-141\nexport const getB64BasePdf = async (\n  customPdf: ArrayBuffer | Uint8Array | string,\n): Promise => {\n  if (\n    typeof customPdf === 'string' &&\n    !customPdf.startsWith('data:application/pdf;') &&\n    typeof window !== 'undefined'\n  ) {\n    const response = await fetch(customPdf);  // <-- No URL validation\n    const blob = await response.blob();\n    return blob2Base64Pdf(blo","public_affected_ranges":["SEMVER: introduced 0; fixed 5.5.10"]}],"null_published_at":"2026-11-03T22:39:43.352Z","source_updated_at":"2026-10-24T02:56:54.238Z","source_disclosed_at":"2026-03-20T20:45:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:35:22.946Z"}],"next_cursor":null,"snapshot_revision":"39771"}