CVE-2026-82865 Overview
CVE-2026-82865 is a cross-site scripting (XSS) vulnerability affecting pdfme schemas prior to version 5.5.10. The flaw resides in the multiVariableText property panel, which assigns unsanitized i18n label values directly to innerHTML. Attackers who control label overrides through the options.labels configuration can inject arbitrary JavaScript. The payload executes when a user opens the pdfme Designer and selects a multiVariableText field that has no variable placeholders. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers who influence i18n label configuration can execute arbitrary JavaScript in the context of the Designer user, enabling session theft or in-app actions.
Affected Products
- pdfme schemas package versions prior to 5.5.10
- Applications embedding the pdfme Designer with user-influenced options.labels
- Downstream libraries bundling vulnerable pdfme releases
Discovery Timeline
- 2026-08-31 - CVE-2026-82865 published to the National Vulnerability Database
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82865
Vulnerability Analysis
The defect exists in the pdfme Designer property panel for multiVariableText fields. When rendering internationalized labels supplied through options.labels, the code assigns the label string to a DOM element via innerHTML without sanitization or encoding. Any HTML markup contained in the label, including <script> tags or event handler attributes, is parsed and executed by the browser. Because the render path only fires when a multiVariableText field is selected and contains no variable placeholders, exploitation depends on a specific user interaction within the Designer interface.
Root Cause
The root cause is unsafe DOM sink usage. The property panel treats i18n label values as trusted content and injects them into the document with innerHTML instead of textContent or an equivalent escaping API. The design assumes that label overrides originate from the application developer, but many integrations expose these overrides to lower-privileged users or dynamic configuration sources.
Attack Vector
An attacker requires a way to influence the options.labels object consumed by the pdfme Designer. This is typically achieved when an application allows tenants, contributors, or configuration files to define custom localization strings. Once a malicious label is stored, any Designer user who opens the affected multiVariableText field triggers script execution in their browser session. The attack requires user interaction and the presence of a specific field configuration, which explains the low CVSS 4.0 rating.
No public proof-of-concept code is available. See the GitHub Security Advisory and the VulnCheck Advisory on XSS for further technical detail.
Detection Methods for CVE-2026-82865
Indicators of Compromise
- Unexpected <script>, <img onerror=>, or other HTML markup present in stored options.labels values for pdfme integrations.
- Browser console errors or Content Security Policy violations originating from the pdfme Designer UI.
- Outbound requests from Designer users to unfamiliar domains shortly after opening a multiVariableText field.
Detection Strategies
- Inventory all applications and internal tools that embed pdfme and identify installed versions below 5.5.10.
- Audit configuration stores, databases, and translation files for label values containing HTML tags or JavaScript URI schemes.
- Enable Content Security Policy reporting on pages hosting the pdfme Designer to surface inline script execution attempts.
Monitoring Recommendations
- Log write operations to any data source that supplies i18n labels to pdfme and alert on payloads matching XSS signatures.
- Monitor Designer user sessions for anomalous DOM activity or unexpected token exfiltration.
- Track dependency manifests (package.json, package-lock.json, yarn.lock) in CI for vulnerable pdfme versions.
How to Mitigate CVE-2026-82865
Immediate Actions Required
- Upgrade the @pdfme/schemas package and any dependent pdfme packages to version 5.5.10 or later.
- Review and sanitize existing options.labels values in databases, configuration files, and translation catalogs.
- Restrict who can modify i18n label overrides to trusted administrators until patching completes.
Patch Information
The issue is fixed in pdfme schemas version 5.5.10. Refer to the GitHub Security Advisory GHSA-xgx4-2wgv-4jhm for release details and update guidance.
Workarounds
- Avoid passing user-controlled or externally-sourced strings into options.labels until the patched version is deployed.
- Pre-sanitize label values with an HTML-encoding routine before storing or forwarding them to pdfme.
- Enforce a strict Content Security Policy that disallows inline script execution on pages hosting the Designer.
# Configuration example
npm install @pdfme/schemas@^5.5.10
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
