PT-2025-29133 · Pdfme · Pdfme

Arkark · Published 2025-07-10 · Updated 2025-07-12 · CVE-2025-53626

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: pdfme versions 5.2.0 through 5.4.0

Description: The expression evaluation feature in pdfme contains critical vulnerabilities allowing sandbox escape, leading to Cross-Site Scripting (XSS) and prototype pollution attacks. Attackers can bypass the sandbox restrictions to execute arbitrary JavaScript code using methods like Object.getOwnPropertyDescriptor and Object.getPrototypeOf. The expression evaluator also allows access to prototype accessor methods (lookupGetter, lookupSetter, defineGetter, defineSetter) which can be exploited with Object.assign to pollute the prototype chain. These vulnerabilities can allow attackers to execute arbitrary JavaScript code, steal sensitive information, modify application behavior, and potentially perform actions on behalf of users.

Recommendations: pdfme versions prior to 5.4.1 are affected. Update to pdfme version 5.4.1 to resolve this issue.

Exploit

Fix

Prototype Pollution

XSS

Code Injection

Weakness Enumeration

CWE-1321

CWE-79

CWE-94

Related Identifiers

CVE-2025-53626

GHSA-54XV-94QV-2GFG

Affected Products

Pdfme

References · 13

• 🔥 https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53626.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53626 · Security Note
• https://osv.dev/vulnerability/GHSA-54xv-94qv-2gfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53626 · Vendor Advisory
• https://github.com/pdfme/pdfme · Note
• https://github.com/pdfme/pdfme/pull/1117 · Note
• https://github.com/pdfme/pdfme/releases/tag/5.4.1 · Note
• https://github.com/pdfme/pdfme/commit/0dd54739acff2c249ed68c001a896bee38f0fd85 · Note
• https://twitter.com/labelmake/status/1943842797880234263 · Twitter Post
• https://twitter.com/labelmake/status/1943842891895648390 · Twitter Post
• https://twitter.com/CVEnew/status/1943668218335535397 · Twitter Post
• https://t.me/cvenotify/128432 · Telegram Post