CVE-2025-53626: @pdfme/common Vulnerable to XSS and Prototype Pollution via Expression Evaluation
Summary
CVE-2025-53626: @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation. Affects @pdfme/common versions >= 5.2.0, < 5.4.1. Fixed in 5.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @pdfme/common package is a library used for generating PDF documents in JavaScript applications. It provides features for creating and manipulating PDF files, including support for templates and dynamic content. However, versions 5.2.0 to 5.4.0 contain critical vulnerabilities that allow attackers to exploit the expression evaluation feature, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the expression evaluator's sandbox, which can be bypassed to execute arbitrary JavaScript code. Attackers can leverage methods like Object.getOwnPropertyDescriptor to gain access to the Function constructor, allowing them to execute malicious scripts. This can lead to Cross-Site Scripting (XSS) attacks, where attackers can steal sensitive information or manipulate application behavior. Additionally, the evaluator permits prototype pollution through access to prototype accessor methods, enabling attackers to modify the prototype chain and impact the application’s functionality.
How To Fix
Minimum fixed version
5.4.1
This is the first release that contains the fix.
npm install @pdfme/common@5.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the expression evaluation feature in versions 5.2.0 to 5.4.0 until you can update to the patched version. If you must use it, ensure that user input is sanitized and validated to mitigate potential risks.
Conclusion
The @pdfme/common package has a critical vulnerability that can lead to XSS and prototype pollution. It is essential to update to version 5.4.1 or later to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for @pdfme/common →
FAQ
CVE-2025-53626 is a vulnerability in the @pdfme/common package that allows for XSS and prototype pollution through its expression evaluation feature.
Versions 5.2.0 to 5.4.0 of the @pdfme/common package are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to arbitrary JavaScript execution, allowing attackers to steal sensitive information, modify application behavior, and perform actions on behalf of users.
If you cannot update the package, avoid using the expression evaluation feature and ensure that any user inputs are properly sanitized to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @pdfme/common.
