AIKIDO-2026-841274

TL;DR

The @svgdotjs/svg.js event system registers listeners by splitting an event string into an event name and namespace and storing them in a plain object keyed by those values. Because the registry uses ordinary objects, an event name or namespace such as __proto__, constructor, or prototype writes through the prototype accessor and mutates Object.prototype. An application that forwards untrusted strings into on() can trigger silent global prototype pollution, leading to logic corruption or denial of service. The fix builds the event registry with prototype-less objects so these names are treated as ordinary data.