Is CVE-2026-82865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82865 being exploited in the wild.

How severe is CVE-2026-82865?

Medium severity, with a CVSS score of 4.4, published 31 August 2026.

Which products and versions are affected?

@pdfme/schemas (npm) SEMVER:introduced=0,fixed=5.5.10.

Is there a fix for CVE-2026-82865?

Yes. @pdfme/schemas (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82865 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82865?

Check whether you run @pdfme/schemas (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82865: PDFME multiVariableText XSS via unsanitized i18n label injection

CVE-2026-82865 · Severity: medium · CVSS 4.4 · Published 2026-08-31

PDFME is a JavaScript PDF generation and editing library used in web applications. An attacker who can control label configuration can inject malicious JavaScript that executes when users open a PDF template designer and select a multiVariableText field. This allows session hijacking, credential theft, and malicious form overlays affecting all users in multi-tenant deployments.

Technologies: @pdfme/schemas (npm). Vendors: npm.

Quick answers

Is CVE-2026-82865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82865 being exploited in the wild.
How severe is CVE-2026-82865?: Medium severity, with a CVSS score of 4.4, published 31 August 2026.
Which products and versions are affected?: @pdfme/schemas (npm) SEMVER:introduced=0,fixed=5.5.10.
Is there a fix for CVE-2026-82865?: Yes. @pdfme/schemas (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82865 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82865?: Check whether you run @pdfme/schemas (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@pdfme/schemas (npm): upgrade to 5.5.10 or later
```
npm install @pdfme/schemas@5.5.10
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the multiVariableText property panel. The vulnerable code constructs HTML via string concatenation and assigns it directly to innerHTML using unsanitized values from the i18n (internationalization) label lookup function. An attacker who controls the options.labels parameter can inject arbitrary HTML and JavaScript through label override values that are deep-merged into the i18n dictionary with no content validation. The attack requires an attacker to control application configuration or inject labels via a compromised API, but executes with no additional user interaction beyond opening the Designer. The patch replaces innerHTML with safe DOM APIs (textContent and createElement) to ensure label values are always treated as text, never parsed as HTML.

Affected products

pdfme @pdfme/schemas ≤ 5.5.9

Identifiers

CVE-2026-82865
GHSA-xgx4-2wgv-4jhm

Timeline

2026-03-20: disclosed
2026-03-20: patched: Version 5.5.10 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.