CVE-2026-15697

MEDIUM 6.3

svgdotjs svg.js npm Package API EventTarget.on prototype pollution

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-1321 CWE-94
Vendor	svgdotjs
Product	svg.js
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for svgdotjs svg.js

Be the first to know when new medium vulnerabilities affecting svgdotjs svg.js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

svgdotjs / svg.js

3.2.0 3.2.1 3.2.2 3.2.3 3.2.4 3.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/378244 vuldb.com: https://vuldb.com/vuln/378244/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15697 vuldb.com: https://vuldb.com/submit/856013 github.com: https://github.com/svgdotjs/svg.js/issues/1343 github.com: https://github.com/svgdotjs/svg.js/

Credits

🔍 wjm1 (VulDB User) VulDB CNA Team