CVE-2026-82868 Overview
CVE-2026-82868 is a cross-site scripting (XSS) vulnerability in the @pdfme/schemas package before version 5.5.9. The SVG schema plugin renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can embed scripts, event handlers, or foreignObject elements inside SVG payloads to execute arbitrary JavaScript when a victim views or fills a template. The flaw is tracked as CWE-79 and affects applications that consume the pdfme template engine on the client side.
Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user who views or fills a template that includes a malicious SVG schema.
Affected Products
- @pdfme/schemas npm package versions prior to 5.5.9
- Applications embedding the pdfme template designer or viewer that use the SVG schema plugin
- Downstream projects redistributing vulnerable @pdfme/schemas builds
Discovery Timeline
- 2026-08-31 - CVE-2026-82868 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82868
Vulnerability Analysis
The @pdfme/schemas package provides schema plugins for the pdfme PDF template engine, including an SVG schema used to render vector graphics inside templates. The SVG plugin assigns user-controlled SVG markup to an element's innerHTML property without applying an HTML or SVG sanitizer. Because SVG documents can contain <script> tags, event handler attributes such as onload and onclick, and <foreignObject> elements that host arbitrary HTML, any attacker-supplied SVG becomes an active script vector in the rendering context.
Exploitation requires that a user view or interact with a template containing an attacker-controlled SVG schema, which aligns with the user-interaction requirement in the CVSS vector. Successful exploitation yields JavaScript execution under the origin of the hosting application, enabling session token theft, template tampering, and pivoting to other authenticated APIs.
Root Cause
The root cause is missing output sanitization in the SVG schema plugin. Direct innerHTML assignment bypasses the browser's parser safeguards for script content and permits execution of embedded event handlers and inline scripts. Version 5.5.9 introduces sanitization to strip active content before rendering.
Attack Vector
An attacker crafts a pdfme template that includes an SVG schema field populated with malicious markup. When a victim opens the template in the designer, viewer, or form-filling component, the browser parses and executes the embedded script. Delivery paths include shared template files, template marketplaces, and any application feature that accepts user-supplied SVG content and passes it to @pdfme/schemas for rendering.
For technical details of the payload structure and patch, refer to the GitHub Security Advisory GHSA-87v3-4cfp-cm76 and the VulnCheck Advisory for PDFme XSS.
Detection Methods for CVE-2026-82868
Indicators of Compromise
- SVG content within stored pdfme templates containing <script> tags, on* event handler attributes, or <foreignObject> nodes
- Unexpected outbound requests from browser sessions rendering pdfme templates, particularly to attacker-controlled domains
- Content Security Policy (CSP) violation reports referencing inline script execution on pages hosting the pdfme designer or viewer
Detection Strategies
- Perform dependency inventory across front-end projects and flag any resolved version of @pdfme/schemas below 5.5.9 using npm ls @pdfme/schemas or software composition analysis tooling
- Scan stored template JSON for SVG fields and inspect them for script tags, event handlers, or external references before rendering
- Enable browser-side CSP with script-src restrictions and monitor report-uri endpoints for violations tied to template rendering pages
Monitoring Recommendations
- Log and alert on template uploads or edits that include SVG content, with server-side sanitization applied before storage
- Correlate authentication anomalies (unexpected session reuse, token exfiltration) with users who recently opened shared templates
- Track npm audit and GitHub Dependabot alerts for @pdfme/schemas across build pipelines
How to Mitigate CVE-2026-82868
Immediate Actions Required
- Upgrade @pdfme/schemas to version 5.5.9 or later in all affected applications and rebuild front-end bundles
- Audit existing templates in storage and remove or sanitize any SVG schema fields containing scripts, event handlers, or foreignObject elements
- Restrict template upload permissions to trusted users until the patched version is deployed
Patch Information
The maintainers released @pdfme/schemas 5.5.9 with sanitization applied to SVG rendering. Consumers should update the direct dependency and any transitive references pulled in by @pdfme/generator, @pdfme/ui, or related pdfme packages. See the GitHub Security Advisory GHSA-87v3-4cfp-cm76 for the fix commit and affected version ranges.
Workarounds
- Apply a server-side SVG sanitizer such as DOMPurify with SVG profile before persisting or serving template content
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins
- Disable or remove the SVG schema plugin from pdfme configurations if it is not required by the application
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
