CVE-2026-82867
Received Received - Intake

XSS in pdfme Select Schema Plugin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82867
EUVD
EUVD-2026-68402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pdfme schemas to 5.5.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82867 is a cross-site scripting (XSS) vulnerability in the @pdfme/schemas library versions before 5.5.9. It affects the Select schema plugin where option values are not sanitized before being inserted into HTML using innerHTML. Attackers can inject malicious JavaScript via crafted templates, which executes in users' browsers when the select element loads.

Detection Guidance

To detect this vulnerability, inspect your system for versions of @pdfme/schemas prior to 5.5.9. Check package.json files or run commands like 'npm list @pdfme/schemas' or 'yarn list @pdfme/schemas' to verify installed versions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in your browser if you load a malicious template. Potential impacts include session hijacking, keylogging, phishing attacks, and data theft. It requires user interaction, such as loading a compromised template via file upload or shared template.

Mitigation Strategies

Immediately update @pdfme/schemas to version 5.5.9 or later. If updating is not possible, avoid using untrusted templates or sanitize option values before rendering. Replace innerHTML usage with DOM APIs like createElement for safer HTML generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart