Medium severity · published Aug 31, 2026
CVE-2026-82868
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
schemas · pdfme
before 5.5.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82868
vendor-advisory
https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76
third-party-advisory
https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-svg
More from schemas
6.1
CVE-2026-82867
@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
4.4
CVE-2026-82865
pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label