Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas

Description

The SVG schema plugin in @pdfme/schemas renders user-supplied SVG content using container.innerHTML = value without any sanitization, enabling arbitrary JavaScript execution in the user’s browser.

Recommendation

Update the @pdfme/schemas package to the latest compatible version. Followings are version details:

Affected version(s): <= 5.5.8
Patched version(s): 5.5.9

References

GHSA-87v3-4cfp-cm76
CWE-79
OWASP 2021-A3

Could your website be exposed too?

SmartScanner can check your website for Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 1

See something that needs correcting? Let us knowUpdated March 18, 2026