Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The multiVariableText property panel in @pdfme/schemas constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can control label overrides passed through options.labels can inject arbitrary JavaScript that executes in the context of any user who opens the Designer and selects a multiVariableText field with no {variables} in its text. Details When a user selects a multiVariableText schema field that contains no {variable} placeholders, the property panel renders instructional text by concatenating i18n-translated strings directly into innerHTML. Vulnerable sink — packages/schemas/src/multiVariableText/propPanel.ts:65-71: The comment on line 64 claims "safe string concatenation" but the result is assigned to innerHTML with no HTML escaping applied to typingInstructions or sampleField. i18n lookup has no escaping — packages/ui/src/i18n.ts:903: This is a plain dictionary lookup — no HTML encoding or sanitization.…
Recommended action: Upgrade to 5.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SVG schema plugin in @pdfme/schemas renders user-supplied SVG content using container.innerHTML = value without any sanitization, enabling arbitrary JavaScript execution in the user's browser. Details In packages/schemas/src/graphics/svg.ts, line 87, the SVG schema's ui renderer assigns raw SVG markup directly to innerHTML when in viewer mode or form mode with readOnly: true: The isValidSVG() function (lines 11-37) only validates that the string contains <svg and </svg tags and passes DOMParser well-formedness checks. It does NOT strip or block: - <script tags embedded in SVG - Event handler attributes (onload, onerror, onclick, etc.) - <foreignObject elements containing HTML with event handlers - <animate / <set elements with onbegin / onend handlers - SVG <use elements referencing malicious external resources All of these are valid SVG and pass isValidSVG(), but execute JavaScript when inserted via innerHTML. Attack Vectors 1. Malicious Template (readOnly SVG schema) An…
Recommended action: Upgrade to 5.5.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Select schema plugin in @pdfme/schemas constructs HTML from template-defined option values using unsanitized string interpolation and sets it via innerHTML, enabling arbitrary JavaScript execution. Details In packages/schemas/src/select/index.ts, lines 159-164, the Select schema's ui renderer builds <option elements by directly interpolating option values from the template into an HTML string: The option values come from schema.options, which is an array of strings defined in the template JSON. These values are interpolated directly into the HTML string without any escaping of <, , ", &, or other HTML-special characters. An option value containing " breaks out of the value attribute and allows injection of arbitrary HTML elements and event handlers. Proof of Concept Loading the following template into a pdfme Form or Designer component triggers JavaScript execution: The injected <img onerror element executes JavaScript because it is parsed as HTML when assigned to…
Recommended action: Upgrade to 5.5.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.