CyberRota Analysis
AI-GeneratedThe Select schema plugin in versions prior to 5.5.9 of @pdfme/schemas for Java is vulnerable to cross-site scripting due to inadequate sanitization of option values. This flaw allows attackers to inject malicious HTML and JavaScript, potentially executing arbitrary code in users' browsers. Developers using this library should prioritize updating to the latest version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execute arbitrary code in users' browsers.