PT-2026-24582

CVE-2026-3884

Publicado

2026-03-11

Atualizado

2026-05-07

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions spin.js versions prior to 3.0.0

Description The software is susceptible to Cross-site Scripting (XSS) through the spin() function. This allows an attacker to create multiple alerts for each 'target' element. Exploitation requires prototype pollution, achieved by setting an arbitrary key-value pair on Object.prototype via a crafted URL, enabling the execution of arbitrary JavaScript in the user's browser context.

Recommendations Update to spin.js version 3.0.0 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Eric Cornelissen

Samuel Kajava

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')