CVE-2026-3884

LOW EPSS 5.4%
Published Mar 11, 20263mo ago · Modified Jun 17, 20262w ago
2.0 CVSS 4.0
Low
Find Similar
Published Mar 11, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of more than 1 alert for each 'target' element. An attacker would need to set an arbitrary key-value pair on Object.prototype through a crafted URL achieving a prototype pollution first, before being able to execute arbitrary JavaScript in the context of the user's browser.

CVSS Details

Base Score
2.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
5.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
spin.jsspin.js* <3.0.0

References 2

  • gist.github.com https://gist.github.com/ericcornelissen/1a73e28fa50c3009b0eb51ad2fc19f25
    Broken Link
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-SPINJS-15445079
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.