Description

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-31T09:17:07.110Z",
  "pubdate": "2026-08-31T09:17:07.110Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in pdfme versions prior to 5.5.10. The vulnerability originates from the improper handling of internationalization (i18n) label values within the multiVariableText property panel.\nBy manipulating the options.labels object, an attacker can supply malicious input that is subsequently rendered via innerHTML without appropriate sanitization. This flaw allows for the execution of arbitrary JavaScript within the context of the user's browser session when they interact with the Designer and select a multiVariableText field that lacks variable placeholders.\nThe impact includes potential account takeover, session hijacking, or unauthorized actions performed on behalf of the user within the pdfme environment. Successful exploitation requires an attacker to control or influence the application's configuration options provided to the designer component.\nThis vulnerability is classified as a client-side injection issue, where the trust boundary is compromised by the direct assignment of unsanitized user-controllable input to DOM properties, leading to the execution of attacker-supplied scripts.",
  "technicalDetails": "The vulnerability resides in the multiVariableText property panel component of the pdfme Designer. The root cause is the unsafe usage of the innerHTML property to render i18n label values that are derived from the options.labels configuration object.\nIn the affected versions, the application logic retrieves label strings intended for internationalization. If an attacker possesses the ability to define or override these labels via the options.labels property during the initialization of the pdfme Designer, they can inject malicious HTML/JavaScript payloads. These labels are processed and eventually assigned to the DOM, effectively bypassing the security controls that would normally prevent script execution in the UI.\nThe exploitation flow proceeds as follows: 1. The attacker identifies an application implementation where options.labels can be controlled or provided through external input. 2. The attacker crafts a payload containing a script tag or an event handler (e.g., <img src=x onerror=alert(1)>). 3. This malicious string is passed into the pdfme configuration object under the labels key. 4. When a user opens the Designer and interacts with a multiVariableText field that does not contain variable placeholders, the component triggers a re-render or update of the property panel. 5. The application takes the malicious string from the labels object and assigns it directly to an innerHTML property. 6. The browser parses the injected string, causing the immediate execution of the arbitrary JavaScript payload in the user's browser context.\nThis vulnerability does not explicitly require network exposure if the options object is defined locally or fetched via an untrusted source, but it relies on the execution of the Designer component. There is no inherent authentication requirement if the designer is exposed, as the payload delivery is the primary vector. Because the scripts execute within the browser, the impact is limited to the client-side session, potentially allowing an attacker to exfiltrate sensitive data, manipulate the UI, or perform actions permitted by the user's existing permissions."
}