EUVD-2026-68400
GHSA-v7hf-w8f6-4v98
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs PR:L to control options.labels; AC:H and UI:R reflect the conditional trigger state and required victim interaction; S:C and C:L/I:L reflect browser-context XSS scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 11 npm packages depend on @pdfme/schemas (6 direct, 5 indirect)
Ecosystem-wide dependent count for version 5.5.10.
DescriptionCVE.org
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.
AnalysisAI
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be able to influence the options.labels object passed to the pdfme Designer component - this requires either direct code-level access (insider or supply chain), or an application that exposes label customization to end users (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P, score 2.1) accurately captures the multi-condition nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @pdfme/schemas to version 5.5.10 or later, which is the vendor-released patch per the GHSA advisory at https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbi
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsa
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today