Executive brief
Fabric.js is a popular JavaScript library used for creating and manipulating vector graphics and images on web applications. The loadFromJSON method fails to properly validate URIs before accessing resources, allowing remote attackers to make unauthorized requests to internal network resources and potentially disclose sensitive information.
Technical details
This vulnerability is a Server-Side Request Forgery (SSRF) issue in the loadFromJSON method of Fabric.js, caused by insufficient validation of URIs before resource access. An attacker can exploit this by crafting malicious input containing a specially-formed URI that causes the application to request internal or unintended network resources. The attack requires interaction with the vulnerable library but does not necessarily require authentication or special privileges, depending on the implementation context. Exploitation allows an attacker to access local files or internal services, potentially leading to information disclosure. Patches or updates addressing this vulnerability are expected to be available from the Fabric.js maintainers.
Affected products
- Fabric.js Contributors Fabric.js
Timeline
- 2026-09-15: disclosed