Medium
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
Type: advisorySources: OSV
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-82868
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:09 UTC · Revision 1
Source evidence
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
core-osv · Original sourcePublished 31 Aug 2026, 08:46 UTC
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
osv:CVE-2026-82868
Complete source record
{
"id": "a0bd3d503c0e6ed9b5d3d66851aa07fa7daba51308d06c75e4c7318390f96a81",
"url": "https://osv.dev/vulnerability/CVE-2026-82868",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG",
"summary": "@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.",
"evidence": "osv:CVE-2026-82868",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-82868",
"aliases": [
"CVE-2026-82868",
"GHSA-87v3-4cfp-cm76"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pdfme/pdfme",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3b1769d5be88fd4d291cb9838121f0e4e87c6b9f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.5.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.5.9"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"5.5.8",
"5.5.7",
"5.5.6",
"5.5.5",
"5.5.4",
"5.5.3",
"5.5.2",
"5.5.1",
"5.5.0",
"5.4.8",
"5.4.7",
"5.4.6",
"5.4.4",
"5.4.3",
"5.4.2",
"5.4.1",
"5.4.0",
"5.3.19",
"5.3.18",
"5.3.17",
"5.3.16",
"5.3.15",
"5.3.14",
"5.3.13",
"5.3.12",
"5.3.11",
"5.3.10",
"5.3.9",
"5.3.8",
"5.3.7",
"5.3.6",
"5.3.5",
"5.3.4",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0-beta.0",
"5.3.0",
"5.2.16",
"5.2.15",
"5.2.14",
"5.2.13",
"5.2.12",
"5.2.11",
"5.2.10",
"5.2.9",
"5.2.8",
"5.2.7",
"5.2.5",
"5.2.4",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.7",
"5.1.6",
"5.1.5",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.0",
"4.5.2",
"4.5.1",
"4.5.0",
"4.4.2",
"4.4.1",
"4.4.0",
"4.3.2",
"4.3.1",
"4.3.0",
"4.2.5",
"4.2.4",
"4.2.3",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.1",
"4.1.0",
"4.0.2",
"4.0.0",
"3.4.3",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.0",
"3.2.3",
"3.2.2",
"3.2.1",
"3.2.0",
"3.1.5",
"3.1.3",
"3.1.2",
"3.1.1",
"3.1.0",
"3.0.1",
"3.0.0-beta.2",
"2.2.1",
"2.2.0",
"2.0.2",
"2.0.1",
"2.0.0",
"1.2.6",
"1.2.4",
"1.2.3",
"1.2.2",
"1.2.1",
"1.2.0",
"1.1.9",
"1.1.7",
"1.1.5",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.0.18",
"1.0.17",
"1.0.16",
"1.0.15",
"1.0.14",
"1.0.13",
"1.0.12",
"1.0.11",
"1.0.10",
"1.0.9",
"1.0.8",
"1.0.7",
"1.0.6",
"1.0.5",
"1.0.4",
"1.0.3",
"1.0.2",
"1.0.1",
"1.0.0",
"1.0.0-beta.11",
"1.0.0-beta.10",
"1.0.0-beta.9",
"1.0.0-beta.8",
"1.0.0-beta.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82868.json"
}
}
],
"modified": "2026-10-28T02:30:30.551008344Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82868.json",
"https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76",
"https://nvd.nist.gov/vuln/detail/CVE-2026-82868",
"https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-svg"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82868.json"
}
},
"related_cves": [
{
"value": "CVE-2026-82868",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497675,
"published_at": "2026-08-31T08:46:38.149+00:00"
}