{"id":"CVE-2026-82867","aliases":["GHSA-qq9g-96v4-m3cj"],"url":"https://o3.security/vulnerability/CVE-2026-82867","summary":"@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select","details":"## Summary\n\nThe Select schema plugin in `@pdfme/schemas` constructs HTML from template-defined option values using unsanitized string interpolation and sets it via `innerHTML`, enabling arbitrary JavaScript execution.\n\n## Details\n\nIn `packages/schemas/src/select/index.ts`, lines 159-164, the Select schema's `ui` renderer builds `<option>` elements by directly interpolating option values from the template into an HTML string:\n\n```typescript\nconst options = Array.isArray(schema.options) ? schema.options : [];\nselectElement.innerHTML = options\n  .map(\n    (option) =>\n      `<option value=\"${option}\" ${option === value ? 'selected' : ''}>${option}</option>`,\n  )\n  .join('');\n```\n\nThe `option` values come from `schema.options`, which is an array of strings defined in the template JSON. These values are interpolated directly into the HTML string without any escaping of `<`, `>`, `\"`, `&`, or other HTML-special characters. An option value containing `\">` breaks out of the `value` attribute and allows injection of arbitrary HTML elements and event handlers.\n\n## Proof of Concept\n\nLoading the following template into a pdfme Form or Designer component triggers JavaScript execution:\n\n```json\n{\n  \"basePdf\": { \"width\": 210, \"height\": 297, \"padding\": [20, 20, 20, 20] },\n  \"schemas\": [[\n    {\n      \"name\": \"malicious_select\",\n      \"type\": \"select\",\n      \"content\": \"Normal\",\n      \"options\": [\n        \"Normal\",\n        \"\\\"></option><img src=x onerror=\\\"alert(document.domain)\\\">\"\n      ],\n      \"position\": { \"x\": 20, \"y\": 20 },\n      \"width\": 80,\n      \"height\": 10\n    }\n  ]]\n}\n```\n\nThe injected `<img onerror>` element executes JavaScript because it is parsed as HTML when assigned to `selectElement.innerHTML`.\n\n## Attack Vectors\n\nThe `options` array is defined in the template (not by form-filling end users). The attack requires a malicious template to be loaded, which can happen via:\n1. File upload (e.g., \"Load Template\" functionality in applications)\n2. Shared/imported templates in multi-tenant applications\n3. Templates stored in databases without content sanitization\n4. The `updateTemplate()` API being called with untrusted data\n\nThis vulnerability is triggered in Form mode (for non-readOnly select fields) and Designer mode when the select element is rendered.\n\n## Impact\n\nAn attacker who can supply a malicious template can execute arbitrary JavaScript in the browser of any user who views or interacts with the template. This enables:\n- Session hijacking via cookie/token theft\n- Keylogging of form input data\n- Phishing and page modification\n- Data exfiltration\n\n## Suggested Fix\n\nUse DOM APIs to create option elements safely instead of string interpolation:\n\n```typescript\noptions.forEach((option) => {\n  const optionEl = document.createElement('option');\n  optionEl.value = option;\n  optionEl.textContent = option;\n  if (option === value) optionEl.selected = true;\n  selectElement.appendChild(optionEl);\n});\n```\n\nAlternatively, HTML-encode option values before interpolation:\n```typescript\nconst escape = (s) => s.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n```","published":"2026-08-31T08:46:37.433Z","modified":"2026-10-28T02:30:51.099384667Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@pdfme/schemas","fixedVersion":"5.5.9"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82867.json"},{"type":"ADVISORY","url":"https://github.com/pdfme/pdfme/security/advisories/GHSA-qq9g-96v4-m3cj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82867"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.9-cross-site-scripting-via-select"},{"type":"PACKAGE","url":"https://github.com/pdfme/pdfme"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:51.099384667Z"}}