# CVE-2026-82868: pdfme SVG schema cross-site scripting via innerHTML injection

Source: https://junglewise.ai/threats/cve-2026-82868-pdfme-svg-schema-cross-site-scripting-via-innerhtml-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82868 · Severity: medium · CVSS 6.1 · Published 2026-08-31

The pdfme PDF generation library contains a vulnerability in its SVG schema rendering component that allows attackers to inject malicious JavaScript code. When users view or fill PDF forms with SVG graphics, attackers can execute arbitrary code in their browsers to steal session tokens, capture keyboard input, or exfiltrate sensitive data. This risk is especially severe for SaaS platforms that allow users to upload or share custom PDF templates.

Technologies: [@pdfme/schemas (npm)](https://junglewise.ai/threats/technologies/pdfme-schemas). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-82868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82868 being exploited in the wild.

**How severe is CVE-2026-82868?** Medium severity, with a CVSS score of 6.1, published 31 August 2026.

**Which products and versions are affected?** @pdfme/schemas (npm) SEMVER:introduced=0,fixed=5.5.9.

**Is there a fix for CVE-2026-82868?** Yes. @pdfme/schemas (npm): upgrade to 5.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82868 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82868?** Check whether you run @pdfme/schemas (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @pdfme/schemas (npm): upgrade to 5.5.9 or later

  ```sh
  npm install @pdfme/schemas@5.5.9
  ```


## Technical details

The SVG schema plugin in @pdfme/schemas renders user-supplied SVG content directly to the DOM using container.innerHTML without sanitization. The isValidSVG() validation function only checks for basic XML structure but does not block malicious payloads such as script tags, event handler attributes (onload, onerror, onclick), foreignObject elements containing HTML with handlers, or animate/set elements with onbegin/onend attributes. An attacker can exploit this by crafting a malicious PDF template containing SVG content with embedded JavaScript, which executes when the template is loaded in a Form or Viewer component. User interaction is required (viewing or filling the form), and the attack vector is network-based. The vulnerability is fixed in version 5.5.9; earlier versions up to 5.5.8 are affected.

## Affected products

- pdfme @pdfme/schemas through 5.5.8

## Identifiers

- CVE-2026-82868
- GHSA-87v3-4cfp-cm76

## Timeline

- 2026-03-18: disclosed
- 2026-03-18: patched: Fixed in version 5.5.9

## References

- [https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76](https://github.com/pdfme/pdfme/security/advisories/GHSA-87v3-4cfp-cm76)
- [https://github.com/pdfme/pdfme](https://github.com/pdfme/pdfme)

## Related threats

- [pdfme schemas cross-site scripting in select option](https://junglewise.ai/threats/cve-2026-82867-pdfme-schemas-cross-site-scripting-in-select-option)
- [PDFME multiVariableText XSS via unsanitized i18n label injection](https://junglewise.ai/threats/cve-2026-82865-pdfme-multivariabletext-xss-via-unsanitized-i18n-label-injection)