Medium severity6.1NVD Advisory· Published Aug 31, 2026· Updated Aug 31, 2026
CVE-2026-82868
CVE-2026-82868
Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.