Vulnerability · Published Jul 14, 2026 · Assigned by VulDB

CVE-2026-15697svgdotjs svg.js npm Package API EventTarget.on prototype pollution

Medium 6.3

In plain English

A medium-severity prototype pollution in svg.js from svgdotjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:26.04:LTS	node-svgdotjs-svg.js	no fix listed	UBUNTU-CVE-2026-15697
Ubuntu:26.10	node-svgdotjs-svg.js	no fix listed	UBUNTU-CVE-2026-15697

Affected products (as reported)

Vendor	Product	Versions
svgdotjs	svg.js	3.2.03.2.13.2.23.2.33.2.43.2.5

Weakness: CWE-1321, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-378244 | svgdotjs svg.js npm Package API EventTarget.on prototype pollution vdb-entry, technical-description
VDB-378244 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-15697 | CVE Analysis and Report third-party-advisory
Submit #856013 | Node.js @svgdotjs/svg.js 3.2.5 Prototype Pollution third-party-advisory
https://github.com/svgdotjs/svg.js/issues/1343 issue-tracking
https://github.com/svgdotjs/svg.js/ product