PT-2026-24582

CVE-2026-3884

Published

2026-03-11

Updated

2026-05-07

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions spin.js versions prior to 3.0.0

Description The software is susceptible to Cross-site Scripting (XSS) through the spin() function. This allows an attacker to create multiple alerts for each 'target' element. Exploitation requires prototype pollution, achieved by setting an arbitrary key-value pair on Object.prototype via a crafted URL, enabling the execution of arbitrary JavaScript in the user's browser context.

Recommendations Update to spin.js version 3.0.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Eric Cornelissen

Samuel Kajava

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')