CVE-2026-15697

svgdotjs svg.js npm Package API EventTarget.on prototype pollution

State: Published
Severity: 5.3 Medium
Published: Jul 14, 2026
Updated: Jul 15, 2026
Reserved: Jul 14, 2026

Description

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
CWE-94 Code Injection

Affected Products

Product	Versions
svg.jssvgdotjs	3.2.0Affected 3.2.1Affected 3.2.2Affected 3.2.3Affected 3.2.4Affected 3.2.5Affected

References

VDB-378244 | svgdotjs svg.js npm Package API EventTarget.on prototype pollutionvdb-entrytechnical-description
VDB-378244 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-15697 | CVE Analysis and Reportthird-party-advisory
Submit #856013 | Node.js @svgdotjs/svg.js 3.2.5 Prototype Pollutionthird-party-advisory
https://github.com/svgdotjs/svg.js/issues/1343issue-tracking
https://github.com/svgdotjs/svg.js/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.