What is GHSA-v7hf-w8f6-4v98?

GHSA-v7hf-w8f6-4v98 is a security advisory published by GitHub Security Advisories with Low severity. pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the...

Which CVE IDs does GHSA-v7hf-w8f6-4v98 cover?

GHSA-v7hf-w8f6-4v98 covers the following CVE IDs: CVE-2026-82865. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v7hf-w8f6-4v98?

GHSA-v7hf-w8f6-4v98 has a CVSS v3 base score of 4.4, published by GitHub Security Advisories.

GHSA-v7hf-w8f6-4v98LowCVSS 4.4

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the...

Vendor

GitHub Security Advisories

Published

August 31, 2026

Last Modified

August 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-82865 →

📋 Description

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a multiVariableText field without variable placeholders.

🔗 References (4)

https://github.com/pdfme/pdfme/security/advisories/GHSA-xgx4-2wgv-4jhm
https://nvd.nist.gov/vuln/detail/CVE-2026-82865
https://www.vulncheck.com/advisories/pdfme-schemas-before-5.5.10-cross-site-scripting-via-i18n-label
https://github.com/advisories/GHSA-v7hf-w8f6-4v98