CVE-2026-82868
Received Received - Intake

XSS in pdfme Schemas via SVG Plugin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82868
EUVD
EUVD-2026-68403

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pdfme schemas to 5.5.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82868 is a cross-site scripting (XSS) vulnerability in the @pdfme/schemas library versions before 5.5.9. It occurs because user-supplied SVG content is rendered directly to innerHTML without sanitization, allowing attackers to inject malicious SVG files with embedded scripts or event handlers that execute arbitrary JavaScript in users' browsers when viewing or filling templates.

Detection Guidance

To detect this vulnerability, check if your system uses @pdfme/schemas versions before 5.5.9. Inspect installed npm packages with commands like 'npm list @pdfme/schemas' or 'npm ls @pdfme/schemas'. Review SVG content in templates for suspicious elements like <script>, event handlers (e.g., onload, onclick), or <foreignObject> tags.

Impact Analysis

This vulnerability can lead to session hijacking, keylogging, phishing attacks, and data exfiltration. Attackers can craft malicious templates with SVG content containing JavaScript that executes when loaded into the pdfme Form or Viewer component, particularly in multi-tenant SaaS applications where templates may be user-supplied.

Mitigation Strategies

Immediately update @pdfme/schemas to version 5.5.9 or later using 'npm update @pdfme/schemas'. If updating is not possible, sanitize SVG content before rendering using a library like DOMPurify. Remove or restrict user-supplied SVG content in templates until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart