# CVE-2026-44311: Fabric.js XSS in fabric.Gradient SVG serialization

Source: https://junglewise.ai/threats/cve-2026-44311-fabric-js-xss-in-fabric-gradient-svg-serialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-44311 · Severity: medium · CVSS 5.4 · Published 2026-06-22

Fabric.js is a popular JavaScript library used to create and manipulate HTML5 canvas graphics. A security flaw in the library's SVG export feature allows an attacker to inject malicious code into a drawing's color settings. If a website then displays that drawing as an SVG image, the attacker's code could run in the user's browser, potentially leading to unauthorized data access or account takeover.

Technologies: [Fabric.js](https://junglewise.ai/threats/technologies/fabric-js). Vendors: [Fabric.js](https://junglewise.ai/threats/vendors/fabric-js), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44311 being exploited in the wild.

**How severe is CVE-2026-44311?** Medium severity, with a CVSS score of 5.4, published 22 June 2026.

**Which products and versions are affected?** Fabric.js < 7.4.0; fabric (npm) < 7.4.0, SEMVER:introduced=0,fixed=7.4.0.

**Is there a fix for CVE-2026-44311?** Yes. fabric (npm): upgrade to 7.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44311 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44311?** Check whether you run Fabric.js or fabric (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fabric (npm): upgrade to 7.4.0 or later

  ```sh
  npm install fabric@7.4.0
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper neutralization of user-controlled input during SVG serialization. Specifically, the 'color' field within the 'colorStops' array of a 'fabric.Gradient' object is not properly escaped when converted into SVG <stop> elements via the toSVG() method. An attacker can provide a crafted color string containing HTML tags and JavaScript event handlers (e.g., 'onerror'). If the resulting SVG string is rendered into the DOM using a method like innerHTML, the injected script will execute in the victim's browser context. This issue is fixed in version 7.4.0 by implementing proper attribute escaping.

## Affected products

- fabricjs fabric.js < 7.4.0

## Identifiers

- CVE-2026-44311
- GHSA-w22m-hvvm-xmwx

## Timeline

- 2026-05-18: patched: Version 7.4.0 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date

## References

- [https://github.com/fabricjs/fabric.js/releases/tag/v740](https://github.com/fabricjs/fabric.js/releases/tag/v740)
- [https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx](https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx)

## Related threats

- [Fabric.js stored XSS via unescaped SVG export](https://junglewise.ai/threats/cve-2026-27013-fabric-js-stored-xss-via-unescaped-svg-export)