CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

CVSS 4.0

2.1CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

4.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-08-31

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
• https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.10-cross-site-scripting-via-i18n-label
• https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm

Check your stackJSON