CyberRota Analysis
AI-GeneratedThe vulnerability affects the @pdfme/schemas library in Java, specifically versions prior to 5.5.9, allowing for cross-site scripting (XSS) through unsanitized user-supplied SVG content. Attackers can exploit this flaw to inject malicious scripts, potentially executing arbitrary JavaScript in users' browsers during template interactions. Organizations utilizing this library should prioritize patching to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute arbitrary JavaScript in users' browsers when viewing or filling templates.