fabricjs vulnerabilities

Products

• fabric.js 2

Latest fabricjs CVEs

Newest publication first

1. CVE-2026-44311 Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

   Published 2026-06-22

   Medium·CVSS 6.1 EPSS 0.27%

   Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the col...

2. CVE-2026-27013 Fabric.js Affected by Stored XSS via SVG Export

   Published 2026-02-19

   Medium·CVSS 6.1 EPSS 0.33%

   Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribut...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.