CVE-2026-82867: @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @pdfme/schemas versions before 5.5.9 are exposed when users open or render attacker-supplied templates containing Select schema option values.
What does an attacker need to exploit it?
An attacker needs to supply a malicious template with crafted Select option values containing HTML and JavaScript. Exploitation requires a user to interact with the malicious content in their browser.
How can I determine whether my application is affected?
Check whether your application uses @pdfme/schemas earlier than 5.5.9 and whether it accepts, loads, or renders templates from untrusted sources. Inspect Select schema option values for HTML or JavaScript content.
What should be done if upgrading is not immediately possible?
Do not accept untrusted templates, or reject and sanitize Select option values so they cannot contain HTML or JavaScript before rendering. The vulnerable behavior occurs when option values are interpolated through innerHTML.