CVE-2026-15697: svg.js 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5

Affected technology

svg.js · 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5
svgdotjs

Description’s affected range: up to 3.2.5

Component: npm Package API
Function: EventTarget.on
File: svgdotjs/svg.js

Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.