CVE-2025-53626
pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation
Summary
pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation
Original description
The description as published by the source.
pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com