CVE-2026-82868

Name of the Vulnerable Software and Affected Versions @pdfme/schemas versions prior to 5.5.9

Description The SVG schema plugin renders user-supplied SVG content directly to innerHTML without proper sanitization. This occurs in the ui renderer within the packages/schemas/src/graphics/svg.ts file when in viewer mode or form mode with readOnly set to true. While the isValidSVG() function checks for basic SVG tags and well-formedness, it fails to block malicious elements such as <script> tags, event handler attributes (e.g., onload, onerror), <foreignObject> elements containing HTML, or <animate> elements with onbegin handlers. An attacker can exploit this by providing a malicious template or user-controlled data, leading to arbitrary JavaScript execution in the user's browser. This could result in session hijacking, keylogging of form inputs, phishing, or data exfiltration.

Recommendations Update @pdfme/schemas to version 5.5.9 or later. As a temporary mitigation, sanitize SVG content using a library like DOMPurify before DOM insertion or restrict the use of the SVG schema plugin in templates supplied by untrusted users.