This vulnerability allows the creation of multiple alert() calls per target element when using spin() in spin.js. An attacker can inject arbitrary JavaScript into the user's browser context. The weakness is a classic Cross‑Site Scripting flaw (CWE‑79). To trigger the flaw, the attacker must first manipulate Object.prototype by setting an arbitrary key‑value pair, a form of prototype pollution, through a crafted URL. Once prototype pollution is achieved, the spin() function’s misuse permits execution of malicious scripts.

Any project that includes the outdated spin.js package, specifically all releases prior to 3.0.0. No precise version list is supplied by the CNA data, but all versions before 3.0.0 are affected according to the description.

The CVSS score of 5.1 indicates a moderate severity. EPSS is less than 1 %, suggesting that exploitation likelihood is low, and the vulnerability has not been cataloged as a known exploited vulnerability (not in KEV). The exploitation route requires both prototype pollution and the use of spin(), meaning an attacker must craft a URL to manipulate Object.prototype before triggering the XSS. Given these prerequisites, the risk to a typical deployment is moderate but not negligible. Monitoring for related exploit activity and ensuring mitigation is recommended.