CVE-2026-82865: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pdfme schemas

CVE-2026-82865 is a cross-site scripting vulnerability in pdfme schemas prior to version 5.5.10. The vulnerability exists in the multiVariableText property panel where unsanitized i18n label values are assigned to innerHTML. Attackers with control over label overrides through options.labels can inject arbitrary JavaScript code that executes in the context of the Designer interface when a user selects a multiVariableText field lacking variable placeholders. The CVSS 4.0 base score is 2.1, indicating low severity, with network attack vector, high attack complexity, partial privileges required, and user interaction needed.

An attacker able to control label overrides can execute arbitrary JavaScript in the context of the Designer application when a user interacts with the affected multiVariableText field. This could lead to limited script execution affecting confidentiality, integrity, or availability of the user session or data within the Designer environment. The overall impact is low severity as per CVSS 4.0 scoring.

Upgrade pdfme schemas to version 5.5.10 or later where this vulnerability is fixed. Since the vulnerability is due to unsanitized input assigned to innerHTML, the official fix involves proper input sanitization or escaping in the affected component. No cloud service remediation applies as this is not a cloud-hosted service. Patch status is confirmed fixed in 5.5.10.