Executive brief
Fabric.js is a popular JavaScript library used to create and manipulate HTML5 canvas graphics. A security flaw in the library's SVG export feature allows an attacker to inject malicious code into a drawing's color settings. If a website then displays that drawing as an SVG image, the attacker's code could run in the user's browser, potentially leading to unauthorized data access or account takeover.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper neutralization of user-controlled input during SVG serialization. Specifically, the 'color' field within the 'colorStops' array of a 'fabric.Gradient' object is not properly escaped when converted into SVG <stop> elements via the toSVG() method. An attacker can provide a crafted color string containing HTML tags and JavaScript event handlers (e.g., 'onerror'). If the resulting SVG string is rendered into the DOM using a method like innerHTML, the injected script will execute in the victim's browser context. This issue is fixed in version 7.4.0 by implementing proper attribute escaping.
Affected products
- fabricjs fabric.js < 7.4.0
Timeline
- 2026-05-18: patched: Version 7.4.0 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date