Description
The multiVariableText property panel in @pdfme/schemas constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can control label overrides passed through options.labels can inject arbitrary JavaScript that executes in the context of any user who opens the Designer and selects a multiVariableText field with no {variables} in its text.
Recommendation
Update the @pdfme/schemas package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.5.9
- Patched version(s): 5.5.10
References
Could your website be exposed too?
SmartScanner can check your website for PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas - Vulnerability
- Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
- jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026