CVE-2026-82865

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82865
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82865.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82865
Aliases
Published
2026-08-31T08:46:35.945Z
Modified
2026-09-02T03:47:22.527992427Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label
Details

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82865.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/pdfme/pdfme

Affected ranges

Type
GIT
Repo
https://github.com/pdfme/pdfme
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f838f252ded53c52b2fcfd072c12f3c6ff68782c
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.5.10"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.0-beta.1
1.0.0-beta.10
1.0.0-beta.11
1.0.0-beta.8
1.0.0-beta.9
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.7
1.1.9
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.6
2.*
2.0.0
2.0.1
2.0.2
2.2.0
2.2.1
3.*
3.0.0-beta.2
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.5
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.4.0
3.4.1
3.4.2
3.4.3
4.*
4.0.0
4.0.2
4.1.0
4.1.1
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
5.*
5.0.0
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.2.0
5.2.1
5.2.10
5.2.11
5.2.12
5.2.13
5.2.14
5.2.15
5.2.16
5.2.2
5.2.3
5.2.4
5.2.5
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-beta.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.6
5.4.7
5.4.8
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82865.json"