CVE-2025-53626CWE-1321CWE-79CWE-94

pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation

Medium · published July 10, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-07-10T18:49Z
EPSS history
Timeline
  • 10 JUL 18:49Z
    pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation
    cvelistv5