CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

EUVD-2026-68400

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...