Description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-31T09:17:07.410Z",
  "pubdate": "2026-08-31T09:17:07.410Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Select schema plugin of the @pdfme/schemas library before version 5.5.9. The vulnerability arises from improper handling of user-supplied input within the plugin, allowing for the injection of malicious HTML or JavaScript content. Successful exploitation enables an attacker to execute arbitrary code within the context of the user's browser session. The risk implication involves potential unauthorized actions, session hijacking, or the exfiltration of sensitive information processed by the PDF generation tool. The attack requires an attacker to supply or influence a template containing crafted option values. Because the application processes these values via unsafe DOM manipulation, the library is susceptible to script injection when rendering these options.",
  "technicalDetails": "The vulnerability is localized within the Select schema plugin of the @pdfme/schemas library, specifically affecting versions prior to 5.5.9. The root cause is the insecure utilization of the innerHTML property to render option values defined within the PDF template schema. In web development, assigning raw, unvalidated string data directly to innerHTML bypasses standard browser security mechanisms that would otherwise treat the input as plain text, thereby allowing the browser's HTML parser to interpret any embedded script tags or event handlers.\nThe attack flow begins when an attacker introduces a maliciously crafted PDF template. Within the configuration of a Select schema component, the attacker defines option values that contain injected JavaScript payloads, such as '<img src=x onerror=alert(document.domain)>' or other script-based vectors. When the @pdfme library processes this template and attempts to render the Select component, the vulnerable plugin retrieves these malicious option values.\nBecause the plugin does not perform input sanitization or context-aware encoding, the injected malicious string is passed directly into an innerHTML assignment operation. Upon execution of this assignment, the DOM is modified to include the attacker's elements. If the payload is a script tag or an element with an event handler (e.g., onload, onerror), the browser automatically executes the embedded code within the origin of the host application. This bypasses the boundary between data and executable code.\nThe impact of this vulnerability is significant, as it grants the attacker the capability to execute arbitrary JavaScript in the victim's browser. This can lead to the theft of session tokens via document.cookie access, unauthorized performative actions on behalf of the user, or the redirection of the user to malicious sites. There are no specific authentication or privilege requirements to trigger the vulnerability; it is inherent to the parsing logic of the Select component. The exposure is limited to environments where untrusted PDF templates are provided by external sources and rendered using the vulnerable version of @pdfme/schemas."
}