Medium severity6.1OSV Advisory· Published Jul 10, 2025· Updated Jun 17, 2026
CVE-2025-53626
CVE-2025-53626
Description
pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@pdfme/commonnpm | >= 5.2.0, < 5.4.1 | 5.4.1 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-54xv-94qv-2gfgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-53626ghsaADVISORY
- github.com/pdfme/pdfme/commit/0dd54739acff2c249ed68c001a896bee38f0fd85nvdWEB
- github.com/pdfme/pdfme/pull/1117ghsaWEB
- github.com/pdfme/pdfme/releases/tag/5.4.1ghsaWEB
- github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfgnvdWEB
News mentions
0No linked articles in our index yet.