{"id":"CVE-2026-115729","summary":"@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass","details":"@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.","modified":"2026-10-31T02:30:25.792414352Z","published":"2026-10-23T12:55:09.157Z","related":["GHSA-2rg9-wxfw-wrr7","GHSA-pgx6-7jcq-2qff"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115729.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115729.json"},{"type":"ADVISORY","url":"https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7"},{"type":"ADVISORY","url":"https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115729"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypass"},{"type":"FIX","url":"https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6"},{"type":"PACKAGE","url":"https://github.com/pdfme/pdfme"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pdfme/pdfme","events":[{"introduced":"f838f252ded53c52b2fcfd072c12f3c6ff68782c"},{"fixed":"d03d0bc4994ce6921e152879793c5ff52c5600a6"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"5.5.10"},{"fixed":"6.2.6"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d03d0bc4994ce6921e152879793c5ff52c5600a6"}]},{"range":[{"introduced":"5.5.10"},{"fixed":"6.2.6"}],"source":"DESCRIPTION"}]}}],"versions":["6.2.5","6.2.4","6.2.3","6.2.2","6.2.1","6.2.0","6.1.13","6.1.12","6.1.11","6.1.10","6.1.9","6.1.8","6.1.7","6.1.6","6.1.5","6.1.4","6.1.3","6.1.2","6.1.1","6.1.0","6.0.6","6.0.5","6.0.4","6.0.3","6.0.2","6.0.1","6.0.0","5.5.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115729.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}]}