Medium
@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
Type: advisorySources: OSV
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-82867
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 16:29 UTC · Revision 1
Source evidence
@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
core-osv · Original sourcePublished 31 Aug 2026, 08:46 UTC
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.
osv:CVE-2026-82867
Complete source record
{
"id": "57fc93484152a2088c5a2b69400751a831dcfaa8c04b9cd36966caa934115b06",
"url": "https://osv.dev/vulnerability/CVE-2026-82867",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select",
"summary": "@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.",
"evidence": "osv:CVE-2026-82867",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-82867",
"aliases": [
"CVE-2026-82867",
"GHSA-qq9g-96v4-m3cj"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pdfme/pdfme",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3b1769d5be88fd4d291cb9838121f0e4e87c6b9f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.5.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.5.9"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"5.5.8",
"5.5.7",
"5.5.6",
"5.5.5",
"5.5.4",
"5.5.3",
"5.5.2",
"5.5.1",
"5.5.0",
"5.4.8",
"5.4.7",
"5.4.6",
"5.4.4",
"5.4.3",
"5.4.2",
"5.4.1",
"5.4.0",
"5.3.19",
"5.3.18",
"5.3.17",
"5.3.16",
"5.3.15",
"5.3.14",
"5.3.13",
"5.3.12",
"5.3.11",
"5.3.10",
"5.3.9",
"5.3.8",
"5.3.7",
"5.3.6",
"5.3.5",
"5.3.4",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0-beta.0",
"5.3.0",
"5.2.16",
"5.2.15",
"5.2.14",
"5.2.13",
"5.2.12",
"5.2.11",
"5.2.10",
"5.2.9",
"5.2.8",
"5.2.7",
"5.2.5",
"5.2.4",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.7",
"5.1.6",
"5.1.5",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.0",
"4.5.2",
"4.5.1",
"4.5.0",
"4.4.2",
"4.4.1",
"4.4.0",
"4.3.2",
"4.3.1",
"4.3.0",
"4.2.5",
"4.2.4",
"4.2.3",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.1",
"4.1.0",
"4.0.2",
"4.0.0",
"3.4.3",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.0",
"3.2.3",
"3.2.2",
"3.2.1",
"3.2.0",
"3.1.5",
"3.1.3",
"3.1.2",
"3.1.1",
"3.1.0",
"3.0.1",
"3.0.0-beta.2",
"2.2.1",
"2.2.0",
"2.0.2",
"2.0.1",
"2.0.0",
"1.2.6",
"1.2.4",
"1.2.3",
"1.2.2",
"1.2.1",
"1.2.0",
"1.1.9",
"1.1.7",
"1.1.5",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.0.18",
"1.0.17",
"1.0.16",
"1.0.15",
"1.0.14",
"1.0.13",
"1.0.12",
"1.0.11",
"1.0.10",
"1.0.9",
"1.0.8",
"1.0.7",
"1.0.6",
"1.0.5",
"1.0.4",
"1.0.3",
"1.0.2",
"1.0.1",
"1.0.0",
"1.0.0-beta.11",
"1.0.0-beta.10",
"1.0.0-beta.9",
"1.0.0-beta.8",
"1.0.0-beta.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82867.json"
}
}
],
"modified": "2026-10-28T02:30:51.099384667Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82867.json",
"https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj",
"https://nvd.nist.gov/vuln/detail/CVE-2026-82867",
"https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-select"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82867.json"
}
},
"related_cves": [
{
"value": "CVE-2026-82867",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 519872,
"published_at": "2026-08-31T08:46:37.433+00:00"
}