@pdfme/schemas before version 5.5.9 contains a cross‑site scripting vulnerability in the Select schema plugin. The plugin fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript, allowing them to execute arbitrary code in users' browsers. The impact is code execution in the victim’s browser context, potentially exposing session data, credentials, or allowing further client‑side attacks.

The vendor product affecting this vulnerability is pdfme:schemas. All releases of @pdfme/schemas prior to version 5.5.9 are impacted because the bug resides in the select plugin included in those releases. Versions 5.5.9 and later contain the fix.

The CVSS score of 5.3 indicates moderate severity. Because no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, there is no evidence of widespread exploitation yet, though the risk persists for users who load untrusted templates. Attackers can exploit the flaw through remote input by delivering malicious templates that inject unsanitized option values into the DOM via innerHTML. The likely attack vector is remote client‑side execution through user‑supplied data processed by an application that incorporates the vulnerable @pdfme/schemas library. CWE‑79 classifies this as an injection flaw that permits code injection.