CVE-2026-82865CWE-79cross-site-scripting

CVE-2026-82865

Medium · published August 31, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00203 · 9.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-31T13:17Z
References (3)
https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm · [email protected]https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.10-cross-site-scripting-via-i18n-label · [email protected]https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:46Z
    pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label
    cvelistv5