Description
fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup.
Recommendation
Update the fabric package to the latest compatible version. Followings are version details:
- Affected version(s): < 7.2.0
- Patched version(s): 7.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Fabric.js Affected by Stored XSS via SVG Export and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @diplodoc/search-extension allows stored XSS via Markdown file title - CVE-2026-40201
- HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
- Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization - CVE-2026-44311
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026