The vulnerability is a Server‑Side Request Forgery in the pdfmake library's URLResolver.js component. A remote attacker can provoke the server to resolve arbitrary URLs, which may leak internal data or external resources. The flaw is identified as CWE‑918 and allows attackers to read sensitive information from the server environment.

Affected versions are pdfmake 0.3.0‑beta.2 through 0.3.5. Any deployment that imports pdfmake in server‑side code without a URL access policy is at risk. The patch was released in 0.3.6 and introduces setUrlAccessPolicy and a runtime warning when no policy is defined.

The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the KEV catalog. However, because SSRF can be leveraged to access internal resources, the risk remains significant for applications exposed to untrusted inputs. The attack vector likely involves supplying a malicious URL parameter to pdfmake during document generation.