This vulnerability in svgdotjs svg.js (versions 3.2.0 through 3.2.5) involves improper control over modifications to object prototype attributes via the EventTarget.on function. Such a flaw can lead to prototype pollution, potentially enabling attackers to manipulate application behavior or cause unexpected side effects. The vulnerability is remotely exploitable, requires low privileges, and does not require user interaction. The project was notified early but has not provided a response or patch, and no official remediation is currently available.

An attacker with low privileges can remotely exploit this vulnerability to improperly modify object prototype attributes, which may lead to altered application behavior or security bypasses. The CVSS 4.0 base score is 5.3 (medium severity), reflecting limited but meaningful impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available and the vendor has not responded, users should monitor the project for updates. Until a fix is released, consider applying temporary mitigations such as restricting access to vulnerable functionality or using code-level safeguards against prototype pollution if feasible.