Executive brief
Fabric.js is a popular open-source JavaScript library for creating and manipulating vector graphics on web browsers. The library fails to properly escape user-supplied data when exporting designs to SVG format, allowing attackers to inject malicious code. An attacker can craft a malicious design file, share it with users of affected applications, and execute arbitrary JavaScript when the victim views the exported SVG—potentially stealing session data, modifying page content, or performing unauthorized actions.
Technical details
The vulnerability is a stored XSS weakness arising from incomplete output encoding in SVG export functions. While Fabric.js correctly escapes text content during SVG generation, it fails to escape other user-controlled properties (id, src, pattern IDs, gradient IDs) that are interpolated directly into SVG attribute markup. The attack path is: (1) attacker supplies malicious JSON via loadFromJSON() with crafted id, src, or pattern properties; (2) the unvalidated properties are stored on fabric objects during deserialization; (3) when toSVG() is called, unescaped values break out of XML attributes and inject arbitrary SVG elements with event handlers. Attack requires that the victim application both accepts user-supplied JSON designs and renders exported SVG in a browser context. The vulnerability affects all object types (Rect, Circle, Image, Pattern, Gradient, etc.) through inherited SVG export mixins. Patch available in fabric.js 7.2.0 and later.
Affected products
- Fabric.js Fabric.js <=7.1.0
Timeline
- 2026-02-18: disclosed
- 2026-02-20: patched: Fix released in version 7.2.0