CVE-2026-82868: @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @pdfme/schemas versions before 5.5.9 are exposed when users view or fill templates containing attacker-controlled SVG content handled by the SVG schema plugin.
What does an attacker need to exploit it?
An attacker needs to supply malicious SVG content that is incorporated into a template viewed or filled by another user. The attack requires user interaction because the malicious content executes when the affected template is viewed or filled in a browser.
What SVG content can trigger script execution?
The affected plugin renders supplied SVG directly through innerHTML without sanitization. Malicious SVG can use embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript.
What should teams do to remediate the issue?
Upgrade @pdfme/schemas to version 5.5.9 or later. If upgrading is not immediately possible, do not allow untrusted SVG content in templates processed by the affected SVG schema plugin.