EUVD-2026-68401

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery (SSRF) vulnerability in the getB64BasePdf function. When the basePdf template field is attacker-controlled, the function fetches arbitrary URLs without validation, allowing attackers to force servers or clients to request internal...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: OSV:GHSA-PGX6-7JCQ-2QFF...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMECOMMON-15746945...