Description

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-31T09:17:07.553Z",
  "pubdate": "2026-08-31T09:17:07.553Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists within the SVG schema plugin of the pdfme library, specifically affecting versions prior to 5.5.9.\nThe vulnerability originates from the insecure rendering of user-supplied SVG content, which is injected directly into the DOM via innerHTML without undergoing any sanitization process.\nThis flaw allows remote attackers to inject malicious SVG payloads containing scripts, event handlers, or 'foreignObject' elements.\nSuccessful exploitation enables the execution of arbitrary JavaScript within the context of the user's browser session when they view or interact with a compromised template.\nThe risk implication is significant as it allows for session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.\nNo specific authentication or specialized privilege levels are required to trigger this vulnerability, provided the attacker can influence the template content rendered by the application.\nThe impact is restricted to the client-side environment but poses a severe threat to the integrity and confidentiality of user-application interactions.",
  "technicalDetails": "The vulnerability is localized to the SVG schema plugin within the pdfme library, which is responsible for rendering vector graphic templates. The root cause is the improper handling of SVG data by the rendering engine, which utilizes the innerHTML property to insert SVG content directly into the Document Object Model (DOM).\nBecause the library fails to sanitize input, the browser interprets the provided SVG string as legitimate DOM nodes. SVG is a powerful, XML-based format that supports dynamic content, including the execution of scripts via the <script> element or through event-based attributes such as 'onload' or 'onmouseover'. Furthermore, the 'foreignObject' element allows for the embedding of arbitrary XHTML content, which can be leveraged to introduce malicious iframe or script-based vectors.\nThe attack flow follows a predictable sequence: First, an attacker constructs a malicious template containing an SVG payload. This payload might include an event handler (e.g., <svg onload='alert(1)'>) or a sophisticated script-injected foreignObject. Second, the attacker causes this template to be loaded or filled by the pdfme library in the victim's environment.\nOnce the library renders the template, the browser parses the malicious SVG as part of the page structure. Because the application trusts the input, it executes the embedded JavaScript or triggers the defined event handlers within the origin of the host application.\nPost-exploitation, the attacker gains the ability to execute arbitrary JavaScript within the user's session. This grants the attacker access to session cookies, local storage, and the ability to manipulate the DOM of the host application. The attacker could effectively bypass CSRF protections, perform actions on behalf of the user, or exfiltrate sensitive data displayed within the application interface to an external server under the attacker's control.\nThis vulnerability is particularly dangerous because it does not require prior authentication if the application accepts template inputs from untrusted sources. The lack of input validation or an output encoding strategy creates a direct conduit for code execution, impacting any deployment utilizing pdfme versions earlier than 5.5.9."
}