CVE-2026-82865: pdfme: XSS via unsanitized i18n labels in Designer

MEDIUMPoC AVAILABLECISA: TRACK*

Published August 31, 2026

CISO Take

pdfme schemas before 5.5.10 assign attacker-controlled i18n label overrides directly to innerHTML inside the multiVariableText property panel, allowing arbitrary JavaScript execution in the browser of anyone who opens the Designer and selects an affected field. The CVSS 4.4 score reflects a narrow blast radius — high attack complexity, low privileges required, and mandatory user interaction — but the scope-changed vector means a compromised Designer session can still leak template data or hijack the operator's authenticated session. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template, so this is not an active-exploitation concern today, but the code pattern (unsanitized values into innerHTML) is trivial to weaponize once a proof of concept exists. Any workflow that lets low-privilege users or tenants control label overrides (options.labels) passed into a shared pdfme Designer instance should treat this as exploitable. Patch to pdfme schemas 5.5.10+ immediately, and until then, strip or encode any user- or tenant-supplied values before they reach options.labels.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Overall risk is low-to-moderate. The vulnerability requires an attacker to first get a malicious label value into options.labels (implying some existing low-privilege access or a trusted-input assumption being violated), then requires a victim to actively open the Designer UI and select the specific multiVariableText field lacking variable placeholders. This chain of preconditions (AC:H, UI:R) meaningfully limits mass exploitability, and the impact is capped at limited confidentiality/integrity loss with no availability impact. No KEV listing, no EPSS percentile, and no known public exploit or Nuclei template currently exist, so near-term opportunistic exploitation is unlikely. Risk rises sharply in any deployment where label configuration is exposed to untrusted or multi-tenant input feeding a shared Designer instance used by higher-privileged operators.

How does the attack unfold?

Injection Setup

Attacker with low-privilege access to a label/template configuration surface crafts a malicious i18n label override containing embedded script and gets it stored via options.labels.

User Execution

A victim with Designer access opens pdfme's Designer UI and selects the multiVariableText field associated with the poisoned label, without the field having variable placeholders defined.

AML.T0011

Client-Side Execution

The unsanitized label value is assigned directly to innerHTML in the property panel, causing the attacker's JavaScript to execute in the victim's authenticated browser session.

Impact

The attacker's script exfiltrates session cookies/tokens or silently tampers with PDF templates, enabling session hijacking or unauthorized document generation changes.

Injection Setup

Attacker with low-privilege access to a label/template configuration surface crafts a malicious i18n label override containing embedded script and gets it stored via options.labels.

User Execution

A victim with Designer access opens pdfme's Designer UI and selects the multiVariableText field associated with the poisoned label, without the field having variable placeholders defined.

AML.T0011

Client-Side Execution

The unsanitized label value is assigned directly to innerHTML in the property panel, causing the attacker's JavaScript to execute in the victim's authenticated browser session.

Impact

The attacker's script exfiltrates session cookies/tokens or silently tampers with PDF templates, enabling session hijacking or unauthorized document generation changes.

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

Upgrade pdfme and the schemas package to version 5.5.10 or later, which sanitizes i18n label values before DOM insertion. Until patched, treat options.labels as untrusted input: strip HTML/script content or apply strict allow-listing on any values that originate from users, tenants, or external integrations before they are passed into the Designer configuration. Restrict Designer access to trusted, authenticated operators only, and avoid exposing label customization to self-service or multi-tenant surfaces. For detection, review stored template/label configurations for embedded HTML tags or script content, and monitor browser-side error/CSP violation reports from Designer sessions, since a strict Content-Security-Policy (no inline script execution) would also blunt this vulnerability's impact.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageFrameworkAML.T0011- User Execution AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1-Third-party AI system component risk management

Frequently Asked Questions

What is CVE-2026-82865?

Is CVE-2026-82865 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-82865, increasing the risk of exploitation.

How to fix CVE-2026-82865?

Upgrade pdfme and the schemas package to version 5.5.10 or later, which sanitizes i18n label values before DOM insertion. Until patched, treat options.labels as untrusted input: strip HTML/script content or apply strict allow-listing on any values that originate from users, tenants, or external integrations before they are passed into the Designer configuration. Restrict Designer access to trusted, authenticated operators only, and avoid exposing label customization to self-service or multi-tenant surfaces. For detection, review stored template/label configurations for embedded HTML tags or script content, and monitor browser-side error/CSP violation reports from Designer sessions, since a strict Content-Security-Policy (no inline script execution) would also blunt this vulnerability's impact.

What systems are affected by CVE-2026-82865?

This vulnerability affects the following AI/ML architecture patterns: document generation pipelines, AI-generated report pipelines, web-based template editors, multi-tenant admin/ops UI tooling.

What is the CVSS score for CVE-2026-82865?

CVE-2026-82865 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

document generation pipelinesAI-generated report pipelinesweb-based template editorsmulti-tenant admin/ops UI tooling

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

Exploitation Scenario

An attacker with low-privilege access to a shared or multi-tenant system that exposes label customization (e.g., a tenant admin panel that feeds values into pdfme's options.labels) submits a crafted label value containing an HTML/script payload instead of plain text. That malicious label gets persisted in the template configuration. When a higher-privileged user — a document workflow operator or platform admin — later opens the pdfme Designer and selects the associated multiVariableText field (one without variable placeholders defined), the unsanitized label is assigned to innerHTML and the attacker's JavaScript executes in the victim's authenticated browser session. From there the attacker can exfiltrate session cookies/tokens, silently modify PDF templates used for downstream document generation, or pivot to further actions available to the compromised operator account.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.