GHSA-87v3-4cfp-cm76
Medium · 6.1CVSS
6.1
EPSS
—
Published
Mar 18, 2026
CISA due date
—
The record
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @pdfme/schemas | 0 | 5.5.9 |
Related vulnerabilities
- GHSA-xgx4-2wgv-4jhm PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText… Also affects @pdfme/schemas
- GHSA-qq9g-96v4-m3cj Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas Also affects @pdfme/schemas
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79