Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas

Description

The Select schema plugin in @pdfme/schemas constructs HTML from template-defined option values using unsanitized string interpolation and sets it via innerHTML, enabling arbitrary JavaScript execution.

Recommendation

Update the @pdfme/schemas package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.5.8
• Patched version(s): 5.5.9

References

• GHSA-qq9g-96v4-m3cj
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas - Vulnerability
• PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
• Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables - CVE-2025-68115
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350

Tags:

npm

@pdfme/schemas