CVE-2026-82868 in pdfme
Summary
by MITRE • 08/31/2026
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The @pdfme/schemas library prior to version 5.5.9 is susceptible to a critical cross-site scripting vulnerability within its SVG schema plugin architecture. This security flaw stems from the application's failure to properly sanitize user-supplied input before rendering it into the Document Object Model. Specifically, when processing SVG content for template generation or viewing, the software utilizes direct assignment to innerHTML properties without employing any form of output encoding or validation filters. This architectural decision bypasses standard browser-level protections that might otherwise mitigate certain script injection attempts, thereby creating a direct pathway for malicious code execution within the context of the victim's web session.
From a technical perspective, this vulnerability is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the parser accepting raw SVG markup and injecting it directly into the DOM structure. Because SVG elements can contain script tags, event handlers such as onload or onclick, and foreignObject elements that allow embedding HTML content, an attacker can craft a malicious payload that triggers JavaScript execution upon rendering. This is particularly dangerous because modern browsers treat SVG scripts with similar privileges to standard HTML scripts when embedded in this manner, allowing the injected code to access cookies, session tokens, local storage, and other sensitive data associated with the current domain.
The operational impact of this vulnerability is severe for any application relying on @pdfme/schemas for dynamic PDF template creation or visualization. An attacker who can control the input passed to the SVG schema plugin could execute arbitrary JavaScript in the context of the vulnerable web page. This capability enables a range of malicious activities including session hijacking, where stolen credentials allow unauthorized access to user accounts; keylogging to capture sensitive information typed by users; and phishing attacks that manipulate the interface to deceive users into revealing confidential data. Furthermore, if the application is part of an enterprise workflow involving document processing, this vulnerability could be leveraged for drive-by downloads or further network pivoting depending on the surrounding infrastructure's security posture.
To mitigate this risk, organizations must immediately upgrade @pdfme/schemas to version 5.5.9 or later where these sanitization issues have been addressed by implementing robust input validation and output encoding mechanisms. In scenarios where upgrading is not immediately feasible, developers should implement a server-side content security policy that restricts the execution of scripts from untrusted sources and employs strict Content-Security-Policy headers to prevent inline script execution. Additionally, integrating a dedicated HTML sanitization library such as DOMPurify before rendering any user-supplied SVG content can provide an effective defense layer by stripping out dangerous elements like script tags and event handlers while preserving legitimate visual formatting requirements.
This vulnerability aligns with the MITRE ATT&CK technique T1059 which covers Command and Scripting Interpreter execution, specifically within a web browser context as described in sub-techniques related to client-side scripting. The exploitation vector typically falls under Initial Access or Execution phases depending on whether the payload is delivered via social engineering or automated scraping of vulnerable endpoints. Security teams should audit all instances where SVG content is dynamically generated and ensure that no raw user input reaches innerHTML assignments without prior sanitization, thereby closing this attack surface and maintaining the integrity of web-based document processing workflows.