CVE-2026-15697

Name of the Vulnerable Software and Affected Versions svgdotjs svg.js versions prior to 3.2.6

Description A remote attack can be initiated through the npm Package API component. The issue resides in the EventTarget.on() function within the svgdotjs/svg.js file, where improper manipulation allows for the uncontrolled modification of object prototype attributes. This is known as prototype pollution, a condition where an attacker can inject properties into existing JavaScript objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the EventTarget.on() function to minimize the risk of exploitation.