What is CVE-2025-53626?

CVE-2025-53626 is a medium-severity vulnerability in Pdfme, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-07-10.

How severe is CVE-2025-53626?

Medium severity. CVSS v3 base score is 6.1 out of 10.

RCE in Pdfme

CVE-2025-53626

pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (21.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Pdfme — versions >= 5.2.0, < 5.4.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting
CWE-94 — Code Injection
CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-53626?: CVE-2025-53626 is a medium-severity vulnerability in Pdfme, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-07-10.
How severe is CVE-2025-53626?: Medium severity. CVSS v3 base score is 6.1 out of 10.