« Volver al listado

CVE-2025-53626

Estado: AplazadaMedia (6.1)—

pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pdfme — PdfmeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53626",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53626",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-10T19:08:36.795516Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pdfme",
          "product": "pdfme",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.2.0, < 5.4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-10T19:15:27.057",
  "references": [
    {
      "url": "https://github.com/pdfme/pdfme/commit/0dd54739acff2c249ed68c001a896bee38f0fd85",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1."
    },
    {
      "lang": "es",
      "value": "pdfme es un generador de PDF basado en TypeScript y una interfaz de usuario basada en React. La función de evaluación de expresiones de pdfme 5.2.0 a 5.4.0 contiene vulnerabilidades críticas que permiten escapar de la zona protegida, lo que provoca ataques XSS y de contaminación de prototipos. Esta vulnerabilidad se corrige en la versión 5.4.1."
    }
  ],
  "lastModified": "2026-06-17T09:38:35.840",
  "sourceIdentifier": "security-advisories@github.com"
}