Executive brief
PDFME is a JavaScript PDF generation and editing library used in web applications. An attacker who can control label configuration can inject malicious JavaScript that executes when users open a PDF template designer and select a multiVariableText field. This allows session hijacking, credential theft, and malicious form overlays affecting all users in multi-tenant deployments.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the multiVariableText property panel. The vulnerable code constructs HTML via string concatenation and assigns it directly to innerHTML using unsanitized values from the i18n (internationalization) label lookup function. An attacker who controls the options.labels parameter can inject arbitrary HTML and JavaScript through label override values that are deep-merged into the i18n dictionary with no content validation. The attack requires an attacker to control application configuration or inject labels via a compromised API, but executes with no additional user interaction beyond opening the Designer. The patch replaces innerHTML with safe DOM APIs (textContent and createElement) to ensure label values are always treated as text, never parsed as HTML.
Affected products
- pdfme @pdfme/schemas ≤ 5.5.9
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Version 5.5.10 and later