CVE-2026-27013: Fabric.js stored XSS via unescaped SVG export

CVE-2026-27013 · Severity: low · CVSS 3.1 · Published 2026-02-18

Fabric.js is a popular open-source JavaScript library for creating and manipulating vector graphics on web browsers. The library fails to properly escape user-supplied data when exporting designs to SVG format, allowing attackers to inject malicious code. An attacker can craft a malicious design file, share it with users of affected applications, and execute arbitrary JavaScript when the victim views the exported SVG—potentially stealing session data, modifying page content, or performing unauthorized actions.

Technologies: Fabric.js. Vendors: Fabric.js, npm.

Quick answers

Is CVE-2026-27013 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27013 being exploited in the wild.
How severe is CVE-2026-27013?
Low severity, with a CVSS score of 3.1, published 18 February 2026.
Which products and versions are affected?
Fabric.js <=7.1.0; fabric (npm) SEMVER:introduced=0,fixed=7.2.0.
Is there a fix for CVE-2026-27013?
Yes. fabric (npm): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27013 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27013?
Check whether you run Fabric.js or fabric (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fabric (npm): upgrade to 7.2.0 or later
    npm install fabric@7.2.0

Technical details

The vulnerability is a stored XSS weakness arising from incomplete output encoding in SVG export functions. While Fabric.js correctly escapes text content during SVG generation, it fails to escape other user-controlled properties (id, src, pattern IDs, gradient IDs) that are interpolated directly into SVG attribute markup. The attack path is: (1) attacker supplies malicious JSON via loadFromJSON() with crafted id, src, or pattern properties; (2) the unvalidated properties are stored on fabric objects during deserialization; (3) when toSVG() is called, unescaped values break out of XML attributes and inject arbitrary SVG elements with event handlers. Attack requires that the victim application both accepts user-supplied JSON designs and renders exported SVG in a browser context. The vulnerability affects all object types (Rect, Circle, Image, Pattern, Gradient, etc.) through inherited SVG export mixins. Patch available in fabric.js 7.2.0 and later.

Affected products

  • Fabric.js Fabric.js <=7.1.0

Identifiers

  • CVE-2026-27013
  • GHSA-hfvx-25r5-qc3w

Timeline

  • 2026-02-18: disclosed
  • 2026-02-20: patched: Fix released in version 7.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.