Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Date: 2026-03
Affected: npm/@pdfme/schemas
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

## Summary The SVG schema plugin in `@pdfme/schemas` renders user-supplied SVG content using `container.innerHTML = value` without any sanitization, enabling arbitrary JavaScript execution in the user's browser. ## Details In `packages/schemas/src/graphics/svg.ts`, line 87, the SVG schema's `ui` renderer assigns raw SVG markup directly to `innerHTML` when in viewer mode or form mode with `readOnly: true`: ```typescript // svg.ts, line 81-94 (non-editable rendering path) } else { if (!value) return; if (!isValidSVG(value)) { rootElement.appendChild(createErrorElm()); return; } container.innerHTML = value; // <-- VULNERABLE: unsanitized SVG injected into DOM const svgElement = container.childNodes[0]; if (svgElement instanceof SVGElement) { svgElement.setAttribute('width', '100%'); svgElement.setAttribute('height', '100%'); rootElement.appendChild(container); } } ``` The `isValidSVG()` function (lines 11-37) only validates that the string contains `<svg` and `</svg>` tags and passes `DOMParser` well-formedness checks. It does NOT strip or block: - `<script>` tags embedded in SVG - Event handler attributes (`onload`, `onerror`, `onclick`, etc.) - `<foreignObject>` elements containing HTML with event handlers - `<animate>` / `<set>` elements with `onbegin` / `onend` handlers - SVG `<use>` elements referencing malicious external resources All of these are valid SVG and pass `isValidSVG()`, but execute JavaScript when inserted via `innerHTML


Mitigations:

Architectural layers (MAESTRO):