Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82868@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

Medium 6.1

In plain English

A medium-severity cross-site scripting in schemas from pdfme. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@pdfme/schemas	5.5.9	GHSA-87v3-4cfp-cm76

Affected products (as reported)

Vendor	Product	Versions
pdfme	schemas	0 – before 5.5.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-87v3-4cfp-cm76) vendor-advisory
VulnCheck Advisory: @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG third-party-advisory