CVE-2026-82867
CVE-2026-82867 · @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
This page contains facts from public vulnerability sources. Check the original advisory before updating.
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
schemas
- Versions
- ≥ 0, < 5.5.9: Affected (semver)
- 5.5.9: Not affected (semver)
Update to 5.5.9
@pdfme/schemas npm
- Affected ranges
- SEMVER: < 5.5.9
Update to 5.5.9