GHSA-xgx4-2wgv-4jhm
Medium · 4.4CVSS
4.4
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @pdfme/schemas | 0 | 5.5.10 |
Related vulnerabilities
- GHSA-87v3-4cfp-cm76 Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas Also affects @pdfme/schemas
- GHSA-qq9g-96v4-m3cj Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas Also affects @pdfme/schemas
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79