[GHSA-wp52-r2fp-4vmr] pdfmake is vulnerable to server-side request forgery (SSRF)

[mariopepe]

Updates

• References

Comments
I am the original discoverer of this vulnerability. I reported it to MITRE (CVE-2026-26801), coordinated the disclosure with the maintainer, and the fix was released in 0.3.6. Adding my writeup as a reference and requesting analyst credit for Mario Pepe (https://github.com/mariopepe).

[mariopepe]

Hi, could you please add the following credits block to this advisory? I am the original discoverer of CVE-2026-26801 — I reported it to MITRE, coordinated the fix with the maintainer, and the patch shipped in pdfmake 0.3.6.

"credits": [
  {
    "name": "Mario Pepe",
    "contact": [
      "https://github.com/mariopepe"
    ],
    "type": "FINDER"
  }
],

This follows the OSV 1.4.0 schema format, same as PRs #6397, #6229, and #6748.

Thank you.

[mariopepe]

Closing in favor of a new PR from my fork that includes credits.