GHSA-pgx6-7jcq-2qff

## Summary The `getB64BasePdf` function in `@pdfme/common` fetches arbitrary URLs via `fetch()` without any validation when `basePdf` is a non-data-URI string and `window` is defined. An attacker who can control the `basePdf` field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts. ## Details The vulnerability exists in `packages/common/src/helper.ts:130-141`. When `getB64BasePdf` receives a string that does not start with `data:application/pdf;`, and `window` is defined, it passes the string directly to `fetch()`: ```typescript // packages/common/src/helper.ts:130-141 export const getB64BasePdf = async ( customPdf: ArrayBuffer | Uint8Array | string, ): Promise<string> => { if ( typeof customPdf === 'string' && !customPdf.startsWith('data:application/pdf;') && typeof window !== 'undefined' ) { const response = await fetch(customPdf); // <-- No URL validation const blob = await response.blob(); return blob2Base64Pdf(blob); } // ... }; ``` The Zod schema for `basePdf` in `packages/common/src/schema.ts:133-135` accepts any string: ```typescript export const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]); export const BasePdf = z.union([CustomPdf, BlankPdf]); ``` The `checkGenerateProps` function at `packages/common/src/helper.ts:279` only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline. This function is called from multiple entry points: - `packages/generator/src/helper.ts:42` — during PDF generation - `packages/ui/src/hooks.ts:67` — during UI rendering - `packages/ui/src/helper.ts:292` — during template processing The `typeof window !== 'undefined'` guard is comm