What’s Vulnerable › Vulnerabilities

CVE-2026-82867: @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-10-08
• Weakness: CWE-79

Description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.

Affected products

• pdfme schemas: before 5.5.9 — fixed in 5.5.9

How to fix

Upgrade to a fixed version: pdfme schemas 5.5.9. Check the vendor advisory for mitigations.

References

• https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj
• https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-select
• https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj

Get alerted when CVE-2026-82867 or the next vulnerability affects your stack