CVE-2026-82865: pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-10-08
Weakness: CWE-79

Description

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

Affected products

pdfme schemas: before 5.5.10 — fixed in 5.5.10

How to fix

Upgrade to a fixed version: pdfme schemas 5.5.10. Check the vendor advisory for mitigations.

References

https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.10-cross-site-scripting-via-i18n-label
https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm

Get alerted when CVE-2026-82865 or the next vulnerability affects your stack