78 matches found
CVE-2026-26801-pdfmake-ssrf
pdfmake SSRF Vulnerability PoC Vulnerability Summary Field| Value ---|--- Package| pdfmake Version| = 0.3.0-beta.2, CREDENTIALS LEAKED! This proves the vulnerable server made an outbound request to our controlled endpoint. Full Read SSRF npm run exfiltrate The a...
CVE-2024-25180
CVE-2024-25180 Overview pdfmake is a pure JavaScript client/server PDF printing library. The affected versions of this package are vulnerable to arbitrary code injection. An attacker can execute arbitrary code by sending a crafted POST request to the /pdf path. The attacker can execute arbitrary...
CVE-2026-114491
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...
CVE-2026-114491 pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...
EUVD-2026-107419
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...
CVE-2026-114491
The pdfmake library (versions 0.3.8 before 0.3.12 ) contains a vulnerability where it fails to apply the setLocalAccessPolicy() restriction to images referenced within SVG content. This flaw allows an attacker providing a document definition to include an SVG image with an href pointing to a loca...
Security Bulletin: IBM Spectrum Control is vulnerable to a weaknesses related to pdfmake-0.2.10.tgz (CVE-2025-11362)
Summary Pdfmake is vulnerable to a Allocation of Resources Without Limits or Throttling attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-11362 DESCRIPTION: Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to...
Exploit for CVE-2026-26801
pdfmake SSRF Vulnerability PoC Vulnerability Summary | Fi...
CVE-2026-26801
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
@ind-rcg/generator (>=262.1002.0-beta.2, <=264.1004.0-beta.1), @ind-rcg/modeler-sfdx-cli-plugin (>=262.1002.0-beta.4, <=264.1004.0-beta.4) +2 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.2)
pdfmake NPM version =0.3.0-beta.2, =262.1002.0-beta.2, =262.1002.0-beta.4, =262.1002.0-beta.3, =1.0.0, =2.3.0 Source cves: CVE-2026-26801 Source advisory: GHSA-WP52-R2FP-4VMR...
@agentic-ui-experience/ui-arcgis (>=0.0.1-beta.1, <=0.0.1-beta.8), @ai-matrx/agents (>=0.47.1, <=0.59.153) +187 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.12)
pdfmake NPM version =0.3.0-beta.2, =0.0.1-beta.1, =0.47.1, =0.1.0, =0.2.7, =0.1.0, =0.3.0, =0.1.67, =0.24.0, =0.1.0, =0.3.0, =0.8.0, =0.1.0, =0.1.0, =0.4.0, =0.7.0, =0.12.42 and more Source cves: CVE-2026-26801 Source advisory: SNYK:JS-PDFMAKE-15467449...
EUVD-2026-10756
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
Server-side Request Forgery (SSRF)
Overview pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URLResolver component. An attacker can obtain sensitive information by making crafted requests to internal or external resources...
Server-side Request Forgery (SSRF)
Overview org.webjars.npm:pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URLResolver component. An attacker can obtain sensitive information by making crafted requests to internal or...
GHSA-WP52-R2FP-4VMR pdfmake is vulnerable to server-side request forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
@ind-rcg/generator (>=262.1002.0-beta.2, <=264.1004.0-beta.1), @ind-rcg/modeler-sfdx-cli-plugin (>=262.1002.0-beta.4, <=264.1004.0-beta.4) +2 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.2)
pdfmake NPM version =0.3.0-beta.2, =262.1002.0-beta.2, =262.1002.0-beta.4, =262.1002.0-beta.3, =1.0.0, =2.3.0 Source cves: CVE-2026-26801 Source advisory: OSV:GHSA-WP52-R2FP-4VMR...
pdfmake is vulnerable to server-side request forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
EUVD-2026-10757
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
CVE-2026-26801
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...
CVE-2026-26801
Server-Side Request Forgery SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy method allowing server operato...