CVE-2026-15697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15697", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-14T05:01:41.727Z", "datePublished": "2026-07-14T15:15:09.763Z", "dateUpdated": "2026-07-15T14:47:52.297Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-14T15:15:09.763Z"}, "title": "svgdotjs svg.js npm Package API EventTarget.on prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "svgdotjs", "product": "svg.js", "versions": [{"version": "3.2.0", "status": "affected"}, {"version": "3.2.1", "status": "affected"}, {"version": "3.2.2", "status": "affected"}, {"version": "3.2.3", "status": "affected"}, {"version": "3.2.4", "status": "affected"}, {"version": "3.2.5", "status": "affected"}], "cpes": ["cpe:2.3:a:svgdotjs:svg.js:*:*:*:*:*:*:*:*"], "modules": ["npm Package API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-14T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-14T07:06:45.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wjm1 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/378244", "name": "VDB-378244 | svgdotjs svg.js npm Package API EventTarget.on prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/378244/cti", "name": "VDB-378244 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15697", "name": "CVE-2026-15697 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856013", "name": "Submit #856013 | Node.js @svgdotjs/svg.js 3.2.5 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/svgdotjs/svg.js/issues/1343", "tags": ["issue-tracking"]}, {"url": "https://github.com/svgdotjs/svg.js/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T14:47:38.072686Z", "id": "CVE-2026-15697", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:47:52.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:47:38.072686Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:47:46.323Z"}}], "cna": {"title": "svgdotjs svg.js npm Package API EventTarget.on prototype pollution", "credits": [{"lang": "en", "type": "reporter", "value": "wjm1 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:svgdotjs:svg.js:*:*:*:*:*:*:*:*"], "vendor": "svgdotjs", "modules": ["npm Package API"], "product": "svg.js", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}]}], "timeline": [{"lang": "en", "time": "2026-07-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-14T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-14T07:06:45.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/378244", "name": "VDB-378244 | svgdotjs svg.js npm Package API EventTarget.on prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/378244/cti", "name": "VDB-378244 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15697", "name": "CVE-2026-15697 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856013", "name": "Submit #856013 | Node.js @svgdotjs/svg.js 3.2.5 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/svgdotjs/svg.js/issues/1343", "tags": ["issue-tracking"]}, {"url": "https://github.com/svgdotjs/svg.js/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-14T15:15:09.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15697", "state": "PUBLISHED", "dateUpdated": "2026-07-15T14:47:52.297Z", "dateReserved": "2026-07-14T05:01:41.727Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-14T15:15:09.763Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:svgdotjs:svg.js:*:*:*:*:*:*:*:*"], "modules": ["npm Package API"], "product": "svg.js", "vendor": "svgdotjs", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en svgdotjs svg.js hasta la versi\u00f3n 3.2.5. Esto afecta a la funci\u00f3n EventTarget.on del archivo svgdotjs/svg.js del componente npm Package API. Realizar una manipulaci\u00f3n resulta en una modificaci\u00f3n de atributos de prototipo de objeto controlada de forma inadecuada. El ataque puede iniciarse remotamente. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencia, pero a\u00fan no ha respondido."}], "id": "CVE-2026-15697", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15697", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T14:47:38.072686Z", "version": "2.0.3"}}]}, "published": "2026-07-14T16:16:46.143", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/svgdotjs/svg.js/"}, {"source": "cna@vuldb.com", "url": "https://github.com/svgdotjs/svg.js/issues/1343"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15697"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/856013"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/378244"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/378244/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "svg.js: svg.js: Remote object prototype pollution", "id": "2500013", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500013"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-915", "details": ["A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.", "A flaw was found in svgdotjs svg.js. A remote attacker could exploit a vulnerability in the `EventTarget.on` function, which improperly controls modifications to object prototype attributes. This could allow an attacker to manipulate object properties, potentially leading to unintended behavior or data alteration within the application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-15697", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Under investigation", "package_name": "multicluster-engine/console-mce-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Under investigation", "package_name": "rhacm2/console-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-07-14T15:15:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15697\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15697\nhttps://github.com/svgdotjs/svg.js/\nhttps://github.com/svgdotjs/svg.js/issues/1343\nhttps://vuldb.com/cve/CVE-2026-15697\nhttps://vuldb.com/submit/856013\nhttps://vuldb.com/vuln/378244\nhttps://vuldb.com/vuln/378244/cti"], "statement": "A Moderate severity prototype pollution flaw was identified in svg.js, affecting the console components of Red Hat Advanced Cluster Management for Kubernetes and Multicluster Engine for Kubernetes. This vulnerability allows an authenticated remote attacker to manipulate object properties through the `EventTarget.on` function, potentially leading to unintended behavior or data alteration within the application's console. The impact is limited to the console and requires prior authentication.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "svg.js", "source": "cna", "vendor": "svgdotjs"}, "product": "svg.js", "vendor": "svgdotjs"}], "created": "2026-07-16T07:15:16.464878+00:00", "updated": "2026-07-31T10:15:06.129882+00:00", "vendors": ["svgdotjs", "svgdotjs$PRODUCT$svg.js"]}