{"action":"Upgrade @pdfme/common to 5.5.10 or later.","affected":[{"fixed":"5.5.10","introduced":"0"}],"component":"@pdfme/common","cve_ids":["CVE-2026-82866"],"ecosystem":"npm","epss":0.00347,"exploited":false,"fixed_versions":["5.5.10"],"ghsa_id":"GHSA-pgx6-7jcq-2qff","id":"tcs_01M5KG3MHBGRGK04C2ESJ4JY1X","modified_at":"2026-09-01T03:55:42.683394813Z","published_at":"2026-03-20T20:45:17Z","references":["https://osv.dev/vulnerability/GHSA-pgx6-7jcq-2qff","https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff","https://github.com/pdfme/pdfme"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-pgx6-7jcq-2qff","url":"https://osv.dev/vulnerability/GHSA-pgx6-7jcq-2qff"}],"summary":"PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled"}