Schemas
Monthly
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.