LOW 2.1 NVD
CVE-2026-82865
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.
References
- https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
- https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.10-cross-site-scripting-via-
- https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
This low severity vulnerability with a CVSS score of 2.1 was published on 2026-08-31 via NVD.
vulnfeed aggregates 11521 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.