Executive brief
A vulnerability exists in svg.js, a popular JavaScript library used for creating and manipulating SVG graphics. An attacker can exploit this flaw to modify the fundamental behavior of the application's environment, potentially leading to data corruption or service instability. This occurs when the library processes specially crafted event names provided by a user or external source.
Technical details
A prototype pollution vulnerability exists in svgdotjs svg.js up to version 3.2.5 within the EventTarget.on() function. The root cause is improper validation of event names and namespaces; when a string such as '__proto__' is passed as an event name, the internal event registration flow fails to sanitize the input before writing to the event registry object. This allows an attacker to inject properties into the global Object.prototype. Exploitation requires the application to pass attacker-controlled strings into the .on() method, which can lead to logic bypasses, denial of service, or potentially remote code execution depending on the application's environment. As of the advisory date, the project has been notified but a formal patch has not been released.
Affected products
- svgdotjs svg.js up to 3.2.5
Timeline
- 2026-06-08: disclosed: Issue reported to the maintainer via GitHub issue #1343
- 2026-07-14: advisory: CVE published by VulDB/NVD