Fabric.js Affected by Stored XSS via SVG Export

Description

fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup.

Recommendation

Update the fabric package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.2.0
• Patched version(s): 7.2.0

References

• GHSA-hfvx-25r5-qc3w
• CVE-2026-27013
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types - CVE-2026-31868
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737

Tags:

npm

fabric