A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

A flaw was found in svgdotjs svg.js. A remote attacker could exploit a vulnerability in the `EventTarget.on` function, which improperly controls modifications to object prototype attributes. This could allow an attacker to manipulate object properties, potentially leading to unintended behavior or data alteration within the application.

A Moderate severity prototype pollution flaw was identified in svg.js, affecting the console components of Red Hat Advanced Cluster Management for Kubernetes and Multicluster Engine for Kubernetes. This vulnerability allows an authenticated remote attacker to manipulate object properties through the `EventTarget.on` function, potentially leading to unintended behavior or data alteration within the application's console. The impact is limited to the console and requires prior authentication. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Multicluster Engine for Kubernetes Under investigation multicluster-engine/console-mce-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/console-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15697 https://nvd.nist.gov/vuln/detail/CVE-2026-15697 https://github.com/svgdotjs/svg.js/ https://github.com/svgdotjs/svg.js/issues/1343 https://vuldb.com/cve/CVE-2026-15697 https://vuldb.com/submit/856013 https://vuldb.com/vuln/378244 https://vuldb.com/vuln/378244/cti