Vulnerability-Lookup

CVE-2026-27013 (GCVE-0-2026-27013)

Vulnerability from cvelistv5 – Published: 2026-02-19 19:38 – Updated: 2026-02-19 21:21

Title

Fabric.js Affected by Stored XSS via SVG Export

Summary

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session. Version 7.2.0 contains a fix.

Severity ?

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M

References

URL

Tags

	https://github.com/fabricjs/fabric.js/security/ad…	x_refsource_CONFIRM
	https://github.com/fabricjs/fabric.js/commit/7e1a…	x_refsource_MISC
	https://github.com/fabricjs/fabric.js/releases/tag/v720	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	fabricjs	fabric.js	Affected: < 7.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T20:54:40.361805Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T21:21:59.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fabric.js",
          "vendor": "fabricjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim\u0027s browser session. Version 7.2.0 contains a fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T19:38:19.711Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w"
        },
        {
          "name": "https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee"
        },
        {
          "name": "https://github.com/fabricjs/fabric.js/releases/tag/v720",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fabricjs/fabric.js/releases/tag/v720"
        }
      ],
      "source": {
        "advisory": "GHSA-hfvx-25r5-qc3w",
        "discovery": "UNKNOWN"
      },
      "title": "Fabric.js Affected by Stored XSS via SVG Export"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27013",
    "datePublished": "2026-02-19T19:38:19.711Z",
    "dateReserved": "2026-02-17T03:08:23.490Z",
    "dateUpdated": "2026-02-19T21:21:59.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-27013\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-19T20:25:44.230\",\"lastModified\":\"2026-02-20T13:49:47.623\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim\u0027s browser session. Version 7.2.0 contains a fix.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"references\":[{\"url\":\"https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fabricjs/fabric.js/releases/tag/v720\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27013\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-19T20:54:40.361805Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-19T20:54:41.868Z\"}}], \"cna\": {\"title\": \"Fabric.js Affected by Stored XSS via SVG Export\", \"source\": {\"advisory\": \"GHSA-hfvx-25r5-qc3w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"fabricjs\", \"product\": \"fabric.js\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 7.2.0\"}]}], \"references\": [{\"url\": \"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w\", \"name\": \"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee\", \"name\": \"https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/fabricjs/fabric.js/releases/tag/v720\", \"name\": \"https://github.com/fabricjs/fabric.js/releases/tag/v720\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim\u0027s browser session. Version 7.2.0 contains a fix.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-116\", \"description\": \"CWE-116: Improper Encoding or Escaping of Output\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-19T19:38:19.711Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-27013\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-19T21:21:59.208Z\", \"dateReserved\": \"2026-02-17T03:08:23.490Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-19T19:38:19.711Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-HFVX-25R5-QC3W

Vulnerability from github – Published: 2026-02-18 22:44 – Updated: 2026-02-19 21:57

Summary

Fabric.js Affected by Stored XSS via SVG Export

Details

fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via loadFromJSON() and later exported via toSVG(), the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers.

Deserialization Path (no sanitization)

loadFromJSON() (src/canvas/StaticCanvas.ts:1229) calls enlivenObjects() which calls _fromObject() (src/shapes/Object/Object.ts:1902). _fromObject passes all deserialized properties to the shape constructor via new this(enlivedObjectOptions). The constructor ultimately calls _setOptions() (src/CommonMethods.ts:9) which iterates over every property and assigns it to the object via this.set(prop, options[prop]). There is no allowlist or sanitization - any property in the JSON, including id, is set verbatim on the fabric object.

Finding 1: XSS via `id` Property Injection

The id property from deserialized JSON is interpolated directly into SVG attribute strings without escaping.

Vulnerable code (src/shapes/Object/FabricObjectSVGExportMixin.ts, line 89, getSvgCommons()):

getSvgCommons(
  this: FabricObjectSVGExportMixin & FabricObject & { id?: string },
) {
  return [
    this.id ? `id="${this.id}" ` : '',  // <-- unescaped, user-controlled
    this.clipPath
      ? `clip-path="url(#${...})" `
      : '',
  ].join('');
}

This method is called in _createBaseSVGMarkup() (same file, line 178) which wraps every object's SVG output in a <g> element. Every fabric object type (Rect, Circle, Path, Text, Image, Group, etc.) inherits this mixin, so the id injection vector applies to all object types.

Contrast with text content, which IS escaped:

// src/shapes/Text/TextSVGExportMixin.ts:186
return `<tspan ...>${escapeXml(char)}</tspan>`;

The inconsistency shows that the intention was to prevent injection but was missed w attribute contexts.

Finding 2: XSS via Image `src` / `xlink:href` Injection

Image source URLs are interpolated raw into xlink:href in _toSVG().

Vulnerable code (src/shapes/Image.ts, line 404, _toSVG()):

imageMarkup.push(
  '\t<image ',
  'COMMON_PARTS',
  `xlink:href="${this.getSvgSrc(true)}" x="${x - this.cropX}" y="${
    y - this.cropY
  }" ...`  // <-- unescaped
);

getSvgSrc() returns the image src property which is set from JSON during deserialization. An attacker can inject a src value that breaks out of the xlink:href attribute.

Finding 3: XSS via Pattern `sourceToString()`

Vulnerable code (src/Pattern/Pattern.ts, line 181, toSVG()):

`<image x="0" y="0" ... xlink:href="${this.sourceToString()}"></image>`
// <-- unescaped, returns this.source.src for image sources

Additionally, Pattern's constructor (line 92–94) runs this.id = uid() before Object.assign(this, options), meaning a user-supplied id in the pattern JSON overwrites the auto-generated uid. The pattern id is then interpolated unescaped on line 180:

`<pattern id="SVGID_${id}" x="${patternOffsetX}" ...>`

Finding 4: Gradient `id` Partial Injection (lower Severity)

Vulnerable code (src/gradient/Gradient.ts, line 212, toSVG()):

`id="SVGID_${this.id}"`  // <-- unescaped

Gradient's constructor (line 125) computes id: id ?${id}_${uid()}: uid(). If a user-supplied id is present in the gradient JSON, it is prepended to the auto-generated uid. The user-controlled portion is interpolated unescaped into the SVG. This is exploitable but the payload is constrained by the _<uid> suffix appended after it.

Impact

Any application that: 1. Accepts user-supplied JSON (via loadFromJSON(), collaborative sharing, import features, CMS plugins), AND 2. Renders the toSVG() output in a browser context (SVG preview, export download rendered in-page, email template, embed)

...is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session.

Real-world attack scenarios: - Collaborative design tools (Canva-like apps) where users share canvas state as JSON - CMS or e-commerce platforms with fabric.js-based editors that store/render designs - Any export-to-SVG workflow where the SVG is later displayed in a browser

Remediation

Update to fabric.js 7.2.0 or newer version.

Confirmed Affected Files

File	Issue	Method	Exploitable
`src/shapes/Object/FabricObjectSVGExportMixin.ts`	Unescaped `this.id` in attribute	`getSvgCommons()`	Yes - primary vector, all object types
`src/shapes/Image.ts`	Unescaped `getSvgSrc()` in `xlink:href`	`_toSVG()`	Yes
`src/Pattern/Pattern.ts`	Unescaped `sourceToString()` in `xlink:href`; unescaped `id` in attribute	`toSVG()`	Yes
`src/gradient/Gradient.ts`	User-supplied `id` prefix interpolated unescaped	`toSVG()`	Yes (partial - uid suffix appended)

Severity ?

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fabric"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27013"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T22:44:58Z",
    "nvd_published_at": "2026-02-19T20:25:44Z",
    "severity": "HIGH"
  },
  "details": "fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers.\n\n### Deserialization Path (no sanitization)\n\n`loadFromJSON()` (`src/canvas/StaticCanvas.ts:1229`) calls `enlivenObjects()` which calls `_fromObject()` (`src/shapes/Object/Object.ts:1902`). `_fromObject` passes all deserialized properties to the shape constructor via `new this(enlivedObjectOptions)`. The constructor ultimately calls `_setOptions()` (`src/CommonMethods.ts:9`) which iterates over every property and assigns it to the object via `this.set(prop, options[prop])`. There is no allowlist or sanitization - any property in the JSON, including `id`, is set verbatim on the fabric object.\n\n---\n\n### Finding 1: XSS via `id` Property Injection \n\nThe `id` property from deserialized JSON is interpolated directly into SVG attribute strings without escaping.\n\n**Vulnerable code (`src/shapes/Object/FabricObjectSVGExportMixin.ts`, line 89, `getSvgCommons()`):**\n```typescript\ngetSvgCommons(\n  this: FabricObjectSVGExportMixin \u0026 FabricObject \u0026 { id?: string },\n) {\n  return [\n    this.id ? `id=\"${this.id}\" ` : \u0027\u0027,  // \u003c-- unescaped, user-controlled\n    this.clipPath\n      ? `clip-path=\"url(#${...})\" `\n      : \u0027\u0027,\n  ].join(\u0027\u0027);\n}\n```\n\nThis method is called in `_createBaseSVGMarkup()` (same file, line 178) which wraps every object\u0027s SVG output in a `\u003cg\u003e` element. Every fabric object type (Rect, Circle, Path, Text, Image, Group, etc.) inherits this mixin, so the `id` injection vector applies to all object types.\n\n**Contrast with text content, which IS escaped:**\n```typescript\n// src/shapes/Text/TextSVGExportMixin.ts:186\nreturn `\u003ctspan ...\u003e${escapeXml(char)}\u003c/tspan\u003e`;\n```\n\nThe inconsistency shows that the intention was to prevent injection but was missed w attribute contexts.\n\n---\n\n### Finding 2: XSS via Image `src` / `xlink:href` Injection \n\nImage source URLs are interpolated raw into `xlink:href` in `_toSVG()`.\n\n**Vulnerable code (`src/shapes/Image.ts`, line 404, `_toSVG()`):**\n```typescript\nimageMarkup.push(\n  \u0027\\t\u003cimage \u0027,\n  \u0027COMMON_PARTS\u0027,\n  `xlink:href=\"${this.getSvgSrc(true)}\" x=\"${x - this.cropX}\" y=\"${\n    y - this.cropY\n  }\" ...`  // \u003c-- unescaped\n);\n```\n\n`getSvgSrc()` returns the image `src` property which is set from JSON during deserialization. An attacker can inject a `src` value that breaks out of the `xlink:href` attribute.\n\n---\n\n### Finding 3: XSS via Pattern `sourceToString()` \n\n**Vulnerable code (`src/Pattern/Pattern.ts`, line 181, `toSVG()`):**\n```typescript\n`\u003cimage x=\"0\" y=\"0\" ... xlink:href=\"${this.sourceToString()}\"\u003e\u003c/image\u003e`\n// \u003c-- unescaped, returns this.source.src for image sources\n```\n\nAdditionally, Pattern\u0027s constructor (`line 92\u201394`) runs `this.id = uid()` *before* `Object.assign(this, options)`, meaning a user-supplied `id` in the pattern JSON overwrites the auto-generated uid. The pattern `id` is then interpolated unescaped on line 180:\n```typescript\n`\u003cpattern id=\"SVGID_${id}\" x=\"${patternOffsetX}\" ...\u003e`\n```\n\n---\n\n### Finding 4: Gradient `id` Partial Injection (lower Severity)\n\n**Vulnerable code (`src/gradient/Gradient.ts`, line 212, `toSVG()`):**\n```typescript\n`id=\"SVGID_${this.id}\"`  // \u003c-- unescaped\n```\n\nGradient\u0027s constructor (`line 125`) computes `id: id ? `${id}_${uid()}` : uid()`. If a user-supplied `id` is present in the gradient JSON, it is prepended to the auto-generated uid. The user-controlled portion is interpolated unescaped into the SVG. This is exploitable but the payload is constrained by the `_\u003cuid\u003e` suffix appended after it.\n\n---\n\n## Impact\n\nAny application that:\n1. Accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins), AND\n2. Renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed)\n\n...is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim\u0027s browser session.\n\nReal-world attack scenarios:\n- Collaborative design tools (Canva-like apps) where users share canvas state as JSON\n- CMS or e-commerce platforms with fabric.js-based editors that store/render designs\n- Any export-to-SVG workflow where the SVG is later displayed in a browser\n\n---\n\n## Remediation\n\nUpdate to [fabric.js 7.2.0](https://github.com/fabricjs/fabric.js/releases/tag/v720) or newer version. \n\n---\n\n## Confirmed Affected Files\n\n| File | Issue | Method | Exploitable |\n|---|---|---|---|\n| `src/shapes/Object/FabricObjectSVGExportMixin.ts` | Unescaped `this.id` in attribute | `getSvgCommons()` | Yes - primary vector, all object types |\n| `src/shapes/Image.ts` | Unescaped `getSvgSrc()` in `xlink:href` | `_toSVG()` | Yes |\n| `src/Pattern/Pattern.ts` | Unescaped `sourceToString()` in `xlink:href`; unescaped `id` in attribute | `toSVG()` | Yes |\n| `src/gradient/Gradient.ts` | User-supplied `id` prefix interpolated unescaped | `toSVG()` | Yes (partial - uid suffix appended) |",
  "id": "GHSA-hfvx-25r5-qc3w",
  "modified": "2026-02-19T21:57:26Z",
  "published": "2026-02-18T22:44:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27013"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fabricjs/fabric.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabricjs/fabric.js/releases/tag/v720"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fabric.js Affected by Stored XSS via SVG Export"
}

FKIE_CVE-2026-27013

Vulnerability from fkie_nvd - Published: 2026-02-19 20:25 - Updated: 2026-02-20 13:49

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee
	security-advisories@github.com	https://github.com/fabricjs/fabric.js/releases/tag/v720
	security-advisories@github.com	https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim\u0027s browser session. Version 7.2.0 contains a fix."
    }
  ],
  "id": "CVE-2026-27013",
  "lastModified": "2026-02-20T13:49:47.623",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-19T20:25:44.230",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fabricjs/fabric.js/releases/tag/v720"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-27013 (GCVE-0-2026-27013)

GHSA-HFVX-25R5-QC3W

Deserialization Path (no sanitization)

Finding 1: XSS via id Property Injection

Finding 2: XSS via Image src / xlink:href Injection

Finding 3: XSS via Pattern sourceToString()

Finding 4: Gradient id Partial Injection (lower Severity)

Impact

Remediation

Confirmed Affected Files

FKIE_CVE-2026-27013

Tags

Sightings

Nomenclature

Finding 1: XSS via `id` Property Injection

Finding 2: XSS via Image `src` / `xlink:href` Injection

Finding 3: XSS via Pattern `sourceToString()`

Finding 4: Gradient `id` Partial Injection (lower Severity)