CVE-2026-82868mediumCWE-79

CVE-2026-82868: medium-severity vulnerability in pdfme schemas

@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

Published · Updated

Follow this CVE+ Monitor schemas+ Monitor @pdfme/schemas

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
pdfme · schemas
Related CVEs — pdfme schemas

In the same product, most dangerous first.

CVE-2026-82867MEDIUM@pdfme/schemas before 5.5.9 Cross-Site Scripting via SelectEPSS 0.3%CVE-2026-82865LOWpdfme schemas before 5.5.10 Cross-Site Scripting via i18n LabelEPSS 0.2%