CVE-2026-82868: @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-10-08
Weakness: CWE-79

Description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.

Affected products

pdfme schemas: before 5.5.9 — fixed in 5.5.9

How to fix

Upgrade to a fixed version: pdfme schemas 5.5.9. Check the vendor advisory for mitigations.

References

https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76
https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-svg
https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76

Get alerted when CVE-2026-82868 or the next vulnerability affects your stack