CVE-2026-82868: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pdfme schemas

The vulnerability in @pdfme/schemas (versions >=0 and <5.5.9) involves improper neutralization of input during web page generation. Specifically, the SVG schema plugin directly inserts user-supplied SVG content into innerHTML without sanitization, enabling cross-site scripting attacks. Malicious actors can exploit this by embedding scripts, event handlers, or foreignObject elements within SVG content, leading to arbitrary JavaScript execution in the context of the affected web application.

Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of users interacting with affected templates. This can lead to typical XSS impacts such as session hijacking, credential theft, or unauthorized actions performed on behalf of the user. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed and low confidentiality and integrity impact.

A fix is available in version 5.5.9 of @pdfme/schemas. Users should upgrade to version 5.5.9 or later to remediate this vulnerability. Until then, avoid rendering untrusted SVG content or implement additional sanitization controls on SVG inputs to prevent script injection.