@pdfme/schemas before version 5.5.9 renders user‑supplied SVG directly into innerHTML without sanitization, enabling cross‑site scripting attacks. An attacker can embed malicious scripts, event handlers, or foreignObject elements in SVG files so that arbitrary JavaScript executes when a user views or interacts with a template. This flaw can lead to execution of code in the victim’s browser, potentially exposing data or allowing further attacks on the host system.

The vulnerability affects the pdfme:schemas package, specifically releases older than 5.5.9. Users of this Node.js library as part of their PDF generation workflows are impacted, regardless of operating system or deployment environment, as the flaw resides in the application code rather than the host platform.

The CVSS v3 rating of 5.3 classifies the risk as medium, but the flaw is exploitable in any context where a user can load or view a template processed by pdfme/schemas. The EPSS score is not available, so the exact exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploit as of this analysis. Attackers would typically need to trick a user into opening a malicious template or compromise the template creation process to insert the payload.