Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82865pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

Medium 4.4

In plain English

A medium-severity cross-site scripting in schemas from pdfme. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 89.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@pdfme/schemas	5.5.10	GHSA-xgx4-2wgv-4jhm

Affected products (as reported)

Vendor	Product	Versions
pdfme	schemas	0 – before 5.5.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-xgx4-2wgv-4jhm) vendor-advisory
VulnCheck Advisory: pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label third-party-advisory