CVE-2026-44311: Fabric.js XSS in fabric.Gradient SVG serialization

CVE-2026-44311 · Severity: medium · CVSS 5.4 · Published 2026-06-22

Fabric.js is a popular JavaScript library used to create and manipulate HTML5 canvas graphics. A security flaw in the library's SVG export feature allows an attacker to inject malicious code into a drawing's color settings. If a website then displays that drawing as an SVG image, the attacker's code could run in the user's browser, potentially leading to unauthorized data access or account takeover.

Technologies: Fabric.js. Vendors: Fabric.js, npm.

Quick answers

Is CVE-2026-44311 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44311 being exploited in the wild.
How severe is CVE-2026-44311?
Medium severity, with a CVSS score of 5.4, published 22 June 2026.
Which products and versions are affected?
Fabric.js < 7.4.0; fabric (npm) < 7.4.0, SEMVER:introduced=0,fixed=7.4.0.
Is there a fix for CVE-2026-44311?
Yes. fabric (npm): upgrade to 7.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44311 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44311?
Check whether you run Fabric.js or fabric (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fabric (npm): upgrade to 7.4.0 or later
    npm install fabric@7.4.0

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper neutralization of user-controlled input during SVG serialization. Specifically, the 'color' field within the 'colorStops' array of a 'fabric.Gradient' object is not properly escaped when converted into SVG <stop> elements via the toSVG() method. An attacker can provide a crafted color string containing HTML tags and JavaScript event handlers (e.g., 'onerror'). If the resulting SVG string is rendered into the DOM using a method like innerHTML, the injected script will execute in the victim's browser context. This issue is fixed in version 7.4.0 by implementing proper attribute escaping.

Affected products

  • fabricjs fabric.js < 7.4.0

Identifiers

  • CVE-2026-44311
  • GHSA-w22m-hvvm-xmwx

Timeline

  • 2026-05-18: patched: Version 7.4.0 released
  • 2026-06-11: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.