CVE-2026-82865

Name of the Vulnerable Software and Affected Versions pdfme schemas versions prior to 5.5.10

Description The multiVariableText property panel in the schemas module constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can control label overrides passed through the options.labels variable can inject arbitrary JavaScript. This script executes in the context of any user who opens the Designer and selects a multiVariableText field that contains no {variables} in its text. This can lead to session hijacking, DOM manipulation, and data exfiltration.

Recommendations Update pdfme schemas to version 5.5.10 or later. As a temporary workaround, restrict the use of the options.labels variable to ensure only trusted values are passed to the i18n dictionary.