CVE-2026-82865

npm/@pdfme/schemas CVE-2026-82865: medium 4.4, EPSS 0.20%

PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel

Action: Upgrade @pdfme/schemas to 5.5.10 or later.

npm i @pdfme/schemas@5.5.10

Affected

Fixed versions

Sources

• osv: GHSA-xgx4-2wgv-4jhm
• https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
• https://github.com/pdfme/pdfme

CVE-2026-82865 · published 2026-03-20T20:45:08Z · modified 2026-09-01T03:55:42.931305825Z · JSON