{"id":"CVE-2026-44311","aliases":["GHSA-w22m-hvvm-xmwx"],"title":"Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization","summary":"Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization","severity":"medium","cvss":5.4,"cwe":["CWE-79","CWE-116"],"vendor":"fabric","product":"fabric","ecosystem":"npm","affected":["fabric < 7.4.0"],"patched":["fabric 7.4.0"],"published":"2026-06-12","updated":"2026-06-12","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-w22m-hvvm-xmwx","references":[{"url":"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx"},{"url":"https://github.com/fabricjs/fabric.js/releases/tag/v740"},{"url":"https://github.com/advisories/GHSA-w22m-hvvm-xmwx"}],"tags":["ghsa","npm"],"epss":0.00271,"epssPercentile":0.19759,"ingestedAt":"2026-07-07T15:41:58.994Z","slug":"CVE-2026-44311","body":"## Overview\n\n### Summary\n\nA potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the `toSVG()` method.\n\nSpecifically, the `color` field within the `colorStops` array of a `fabric.Gradient` object is not properly escaped when converted into SVG `` elements. If an application renders the generated SVG string into the DOM (e.g., via `innerHTML`), this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser.\n\n### Details\n\nDuring SVG export, Fabric.js serializes gradient color stops into `` elements like:\n\n```xml\n\n```\n\nHowever, the `color` value is inserted into the `stop-color` attribute without proper escaping of special characters such as `\"`, `<`, and `>`. This allows crafted input to break out of the attribute context and inject arbitrary markup.\n\nFor example:\n```js\ncolor: 'red\">

'\n```\n\nmay result in:\n```xml\n\n

\n```\nThis breaks the intended SVG structure and introduces executable HTML.\n\n### PoC (Proof of Concept)\n\nSuccessfully verified on **v7.2.0** (current latest version). The following HTML and JavaScript code reproduces the vulnerability. The code constructs a rectangle with a maliciously crafted gradient color stop and exports it to SVG:\n\n```html\n\n\n\n Fabric.js SVG Export XSS Bypass Test\n \n\n\n

Fabric.js SVG Export XSS Bypass Test (Gradient Color)

\n \n

SVG Output Rendering:

\n\n \n\n\n```\n\n### Impact\n\nThis issue can lead to XSS in applications that:\n1. Allow user-controlled input in gradient definitions (e.g., color values)\n2. Use `canvas.toSVG()` to export content\n3. Insert the resulting SVG string into the DOM without sanitization (e.g., via `innerHTML`)\n\nSuccessful exploitation may result in the execution of arbitrary JavaScript in the victim's browser, theft of sensitive data, or unauthorized actions on behalf of the user.\n\n### Suggested Fix\n**Proper Escaping (Recommended)**: Escape special characters in attribute values during SVG serialization.\n\n## Affected packages\n\n- `fabric < 7.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fabric 7.4.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}