Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82867@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

Medium 6.1

In plain English

A medium-severity cross-site scripting in schemas from pdfme. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@pdfme/schemas	5.5.9	GHSA-qq9g-96v4-m3cj

Affected products (as reported)

Vendor	Product	Versions
pdfme	schemas	0 – before 5.5.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-qq9g-96v4-m3cj) vendor-advisory
VulnCheck Advisory: @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select third-party-advisory