Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

Description

A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method.

Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop> elements.

Recommendation

Update the fabric package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.4.0
• Patched version(s): 7.4.0

References

• GHSA-w22m-hvvm-xmwx
• CVE-2026-44311
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Fabric.js Affected by Stored XSS via SVG Export - CVE-2026-27013
• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
• Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection - CVE-2026-41149

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

fabric