Spin.js

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Spin.js records in CISA KEV

No Spin.js vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Spin.js 1 record LOW

Records

1 record in Spin.js · all components

TI-2026-03361 CVE-2026-3884 · GHSA-h99f-r56h-cmrp

Cross-site scripting in spin.js

LOW 22

Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of more than 1 alert for each 'target' element.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00186 Published 2026-03-11 Fixed in 3.0.0 CWE-79

Open these records in search →