EUVD-2026-68403
GHSA-9f44-gwhq-mr2g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring user interaction to render the template; scope changes to browser context enabling session access beyond the component.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.
AnalysisAI
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control or influence the SVG content value of an SVG-type schema field in a pdfme template - either by having write access to template definitions, or by supplying user-controlled input to a non-readOnly SVG schema field that the application passes directly to the Viewer or Form component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is calibrated appropriately for stored or template-injected XSS of this class: the user-interaction requirement (UI:P) and per-field limited impact (VC:L/VI:L) constrain the theoretical ceiling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 5.5.9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbi
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels con
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today