# CVE-2026-82867: pdfme schemas cross-site scripting in select option

Source: https://junglewise.ai/threats/cve-2026-82867-pdfme-schemas-cross-site-scripting-in-select-option  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82867 · Severity: medium · CVSS 6.1 · Published 2026-08-31

The @pdfme/schemas library is used to render PDF templates with form fields in web browsers. An attacker who can upload or supply a malicious PDF template can inject JavaScript code through crafted option values in select form fields. When a user views the template, the malicious script executes in their browser, enabling account hijacking, data theft, or phishing attacks.

Technologies: [@pdfme/schemas (npm)](https://junglewise.ai/threats/technologies/pdfme-schemas). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-82867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82867 being exploited in the wild.

**How severe is CVE-2026-82867?** Medium severity, with a CVSS score of 6.1, published 31 August 2026.

**Which products and versions are affected?** @pdfme/schemas (npm) SEMVER:introduced=0,fixed=5.5.9.

**Is there a fix for CVE-2026-82867?** Yes. @pdfme/schemas (npm): upgrade to 5.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82867 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82867?** Check whether you run @pdfme/schemas (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @pdfme/schemas (npm): upgrade to 5.5.9 or later

  ```sh
  npm install @pdfme/schemas@5.5.9
  ```


## Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in the Select schema renderer. The vulnerable code in packages/schemas/src/select/index.ts (lines 159-164) builds HTML for <option> elements by directly interpolating unsanitized option values from the template JSON into an HTML string, then assigns it to innerHTML. An attacker can break out of the value attribute using a payload like `"></option><img src=x onerror="alert(document.domain)">` in the schema.options array. The attack vector is network-based with no privilege requirement but requires user interaction (viewing/rendering the template). Attack preconditions include the ability to supply or upload a malicious template, which can occur via file upload, shared templates in multi-tenant apps, or databases without sanitization. The fix is to use DOM APIs (createElement, appendChild) instead of innerHTML, or to HTML-encode option values before interpolation. Versions <= 5.5.8 are affected; version 5.5.9+ contains the patch.

## Affected products

- pdfme @pdfme/schemas <= 5.5.8

## Identifiers

- CVE-2026-82867
- GHSA-qq9g-96v4-m3cj

## Timeline

- 2026-03-18: disclosed
- 2026-03-18: patched: Fixed in version 5.5.9 and later

## References

- [https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj](https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj)
- [https://github.com/pdfme/pdfme](https://github.com/pdfme/pdfme)

## Related threats

- [pdfme SVG schema cross-site scripting via innerHTML injection](https://junglewise.ai/threats/cve-2026-82868-pdfme-svg-schema-cross-site-scripting-via-innerhtml-injection)
- [PDFME multiVariableText XSS via unsanitized i18n label injection](https://junglewise.ai/threats/cve-2026-82865-pdfme-multivariabletext-xss-via-unsanitized-i18n-label-injection)