{"action":"Upgrade @pdfme/common to 5.4.1 or later.","affected":[{"fixed":"5.4.1","introduced":"5.2.0"}],"component":"@pdfme/common","cve_ids":["CVE-2025-53626"],"ecosystem":"npm","epss":0.00329,"exploited":false,"fixed_versions":["5.4.1"],"ghsa_id":"GHSA-54xv-94qv-2gfg","id":"tcs_01M5KF2MR7R9K2G9N5FKFDE4Q2","modified_at":"2026-09-10T03:50:25.739179246Z","published_at":"2025-07-10T17:43:52Z","references":["https://osv.dev/vulnerability/GHSA-54xv-94qv-2gfg","https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg","https://nvd.nist.gov/vuln/detail/CVE-2025-53626","https://github.com/pdfme/pdfme/pull/1117","https://github.com/pdfme/pdfme/commit/0dd54739acff2c249ed68c001a896bee38f0fd85","https://github.com/pdfme/pdfme","https://github.com/pdfme/pdfme/releases/tag/5.4.1"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-54xv-94qv-2gfg","url":"https://osv.dev/vulnerability/GHSA-54xv-94qv-2gfg"}],"summary":"@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation"}