CVE-2026-82867: @pdfme/schemas Select Plugin XSS Vulnerability

CVE-2026-82867 Overview

CVE-2026-82867 is a cross-site scripting (XSS) vulnerability in the @pdfme/schemas package before version 5.5.9. The flaw resides in the Select schema plugin, which fails to sanitize option values before interpolating them into HTML using innerHTML. Attackers can craft malicious templates containing option values with embedded HTML and JavaScript, then execute arbitrary code in the browser of any user who renders the template. The issue is tracked under [CWE-79] and affects applications that consume untrusted pdfme templates. Exploitation requires user interaction, such as loading or previewing an attacker-controlled template in a browser context.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions within pdfme-based applications.

Affected Products

@pdfme/schemas npm package versions prior to 5.5.9
Applications embedding the pdfme Select schema plugin
Web-based PDF template editors and viewers built on pdfme

Discovery Timeline

2026-08-31 - CVE-2026-82867 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82867

Vulnerability Analysis

The vulnerability originates in the Select schema plugin shipped with @pdfme/schemas. When the plugin renders a Select field, it takes each option value from the template definition and writes it directly into the DOM through innerHTML. Because option values pass through no HTML encoding or sanitization step, any markup embedded in the value is parsed as live HTML. An attacker who controls a template can therefore inject <script> tags, event handlers such as onerror, or other executable HTML constructs. Once a victim opens the template in a browser, the injected payload runs under the origin of the hosting application. This grants the attacker access to cookies, tokens, and DOM state accessible to that origin.

Root Cause

The root cause is unsafe use of innerHTML for attacker-influenced data combined with the absence of output encoding. The Select plugin trusts template-supplied strings as safe HTML rather than treating them as untrusted text.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker distributes a malicious pdfme template through file sharing, upload features, or template marketplaces. When a user loads the template in a pdfme-powered editor or viewer, the crafted Select option values execute in the browser. Impact is scoped to the loading user's session but can pivot to further actions in the application.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-qq9g-96v4-m3cj and the VulnCheck Advisory on PDFme for additional technical context.

Detection Methods for CVE-2026-82867

Indicators of Compromise

Template JSON files containing Select schema option values with HTML tags such as <script>, <img>, or <svg> and inline event handlers like onerror, onload, or onclick.
Client-side errors or Content Security Policy (CSP) violation reports originating from pdfme editor or preview components.
Unexpected outbound requests from browser sessions rendering user-supplied pdfme templates.

Detection Strategies

Perform a software composition analysis (SCA) scan across build manifests and lockfiles for @pdfme/schemas versions below 5.5.9.
Add static checks to CI that parse stored pdfme templates and flag Select option values containing angle brackets or JavaScript URI schemes.
Enable and monitor CSP report-uri or report-to endpoints for inline-script violations tied to template rendering pages.

Monitoring Recommendations

Log template upload events with the submitting user, source IP, and a hash of the template payload for retrospective analysis.
Alert on browser telemetry showing script execution from DOM nodes generated by the Select plugin.
Track anomalous session activity, such as token exfiltration attempts, immediately following template rendering.

How to Mitigate CVE-2026-82867

Immediate Actions Required

Upgrade @pdfme/schemas to version 5.5.9 or later across all applications and dependent packages.
Audit stored pdfme templates for malicious Select option values and quarantine any that contain HTML or script content.
Restrict template upload permissions to trusted users until the upgrade is deployed.

Patch Information

The maintainers released a fix in @pdfme/schemas5.5.9. Details are documented in the GitHub Security Advisory GHSA-qq9g-96v4-m3cj. Update package manifests and lockfiles, then rebuild and redeploy affected front-end bundles to ensure the patched version is loaded.

Workarounds

Sanitize template option values on the server before storage using an HTML sanitizer such as DOMPurify.
Deploy a strict Content Security Policy that blocks inline scripts and unsafe event handlers on pages rendering pdfme templates.
Disable or hide the Select schema plugin in end-user editors if the upgrade cannot be applied immediately.

bash

# Configuration example
npm install @pdfme/schemas@^5.5.9
npm audit --production