Description
fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup.
Recommendation
Update the fabric package to the latest compatible version. Followings are version details:
- Affected version(s): < 7.2.0
- Patched version(s): 7.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Fabric.js Affected by Stored XSS via SVG Export and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Etherpad has stored XSS in HTML export via unescaped attribute-pool values - CVE-2026-55090
- ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass - CVE-2026-84371
- JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob - CVE-2026-107303
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026