CVE-2026-3884
MEDIUMspin.js < 3.0.0 - Cross-Site Scripting via Prototype Pollution in spin() Function
Title source: llmDescription
Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of more than 1 alert for each 'target' element. An attacker would need to set an arbitrary key-value pair on Object.prototype through a crafted URL achieving a prototype pollution first, before being able to execute arbitrary JavaScript in the context of the user's browser.
References (2)
Core 2
Core References
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SPINJS-15445079
Scores
CVSS v3
6.1
EPSS
0.0004
EPSS Percentile
12.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
spin.js/spin.js
< 3.0.0
Published
Mar 11, 2026
Tracked Since
Mar 11, 2026