CVE-2026-82865: pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pdfme schemas before 5.5.10 are exposed if untrusted parties can control i18n label overrides through options.labels and users access the Designer.
What must happen for injected JavaScript to execute?
An attacker must supply a malicious label override through options.labels. A user must then open the Designer and select a multiVariableText field that has no variable placeholders.
Are all Designer interactions affected?
No. The described execution path specifically requires selecting a multiVariableText field without variable placeholders.