The vulnerable pdfmake library implements a process‑wide virtual file system for caching remote content. Because the cache key contains only the URL, requests for the same URL made in different PDF contexts share the same cached data without checking per‑document access policies or request headers. An attacker can trick a user or an application into loading a PDF that references a protected resource, causing the library to fetch the resource using credentials or policies belonging to a different caller. The retrieved data can then be read through the malicious PDF, allowing disclosure of content that should otherwise be blocked by the document’s access policy. This flaw is a shared cache access policy bypass and is classified as CWE‑524.

The affected product is the open‑source PDF generation library pdfmake operated by bpampuch. Versions prior to 0.3.14 are vulnerable. Software that imports pdfmake together with older or unpatched releases may be exposed. No other vendors or products are listed as affected.

The CVSS score of 6.3 indicates a medium‑severity flaw. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has no known widespread exploitation yet. Exploitation requires the ability to cause a PDF rendered with the vulnerable library to perform an HTTP request to a target URL that the attacker controls. Attackers could embed a malicious PDF that triggers the fetch of a protected resource, leveraging reused cached data. In practice, the attack surface is limited to environments that render PDFs using pdfmake and that can be persuaded to load a crafted document. Because the cache is keyed solely by URL, an attacker can use the same URL across different rendering contexts to obtain data that should be isolated. The risk is therefore moderate: the flaw can facilitate confidential data leakage if attackers can supply or influence PDF content.