EUVD-2026-43715
GHSA-qf73-72gv-hc6j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L per CVSS 4.0 input; S:U and A:N because prototype pollution in a graphics library does not escalate scope or meaningfully disrupt availability in typical usage.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Prototype pollution in svg.js (svgdotjs) up to version 3.2.5 allows a remote low-privileged attacker to inject arbitrary properties into JavaScript's shared Object.prototype via the EventTarget.on function of the npm package API. Depending on how consuming applications perform property lookups, this can lead to information disclosure, logic bypass, or integrity violations across the entire JavaScript runtime. No vendor patch exists - the maintainer has not responded to the responsible disclosure - and a proof-of-concept exists (CVSS E:P), though no confirmed active exploitation appears in CISA KEV.
Technical ContextAI
svg.js is a widely-used JavaScript/Node.js library for creating and manipulating SVG graphics, distributed via npm as @svgdotjs/svg.js. The affected component is the EventTarget.on method, which binds event listeners to SVG elements. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) describes prototype pollution: attacker-controlled keys such as __proto__, constructor, or prototype are merged or assigned into JavaScript objects without sanitization, allowing injection into the shared Object.prototype chain inherited by all plain objects in the runtime. Because prototype lookups traverse this chain, all objects in the same JavaScript execution context may be affected. In Node.js server-side deployments this class of vulnerability has historically escalated to remote code execution or authentication bypass when consuming application code performs property existence checks on plain objects. CPE cpe:2.3:a:svgdotjs:svg.js:*:*:*:*:*:*:*:* covers all versions through 3.2.5.
RemediationAI
No vendor-released patch has been identified at the time of analysis - the project maintainer was notified via GitHub issue (https://github.com/svgdotjs/svg.js/issues/1343) but has not yet responded. As a primary compensating control, applications should sanitize all user-supplied data before passing it to EventTarget.on, explicitly rejecting or filtering keys matching __proto__, constructor, and prototype prior to any event binding call. For Node.js server-side deployments, consider freezing the prototype at startup with Object.freeze(Object.prototype), though this may conflict with other libraries that rely on prototype extension and should be tested thoroughly before production use. An alternative is replacing direct svg.js event binding with a custom wrapper that performs key validation before delegating to the library. Monitor the GitHub repository (https://github.com/svgdotjs/svg.js/) for a patched release and prioritize upgrading immediately once one is published.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today