Description
A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method.
Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop> elements.
Recommendation
Update the fabric package to the latest compatible version. Followings are version details:
- Affected version(s): < 7.4.0
- Patched version(s): 7.4.0
References
Could your website be exposed too?
SmartScanner can check your website for Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Fabric.js Affected by Stored XSS via SVG Export - CVE-2026-27013
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
- Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection - CVE-2026-41149
You might also like:
See something that needs correcting? Let us knowUpdated July 18, 2026