CVE-2026-82868

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-08-31

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76
• https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-svg
• https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76

Check your stackJSON