CVE-2026-82867

Name of the Vulnerable Software and Affected Versions @pdfme/schemas versions prior to 5.5.9

Description The Select schema plugin fails to sanitize option values before interpolating them into HTML via innerHTML. This allows attackers to supply malicious templates with crafted option values containing HTML and JavaScript, leading to arbitrary code execution in the browsers of users who view or interact with the template. The issue occurs in the ui renderer within packages/schemas/src/select/index.ts, where values from the options array in the template JSON are directly inserted into <option> elements without escaping special characters. This can be exploited through file uploads, shared templates, or the updateTemplate() API.

Recommendations Update @pdfme/schemas to version 5.5.9 or later.