Medium severity · published Aug 31, 2026
CVE-2026-82867
@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
schemas · pdfme
before 5.5.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82867
vendor-advisory
https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj
third-party-advisory
https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-select
More from schemas
6.1
CVE-2026-82868
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
4.4
CVE-2026-82865
pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label