CVE-2025-53626

MEDIUM

pdfme 5.2.0-5.4.0 - Prototype Pollution and Cross-Site Scripting via Expression Evaluation

Title source: llm
STIX 2.1

Description

pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0029
EPSS Percentile 20.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1321 CWE-79 CWE-94
Status published
Products (2)
pdfme/common 5.2.0 - 5.4.1npm
pdfme/pdfme >= 5.2.0, < 5.4.1
Published Jul 10, 2025
Tracked Since Feb 18, 2026