CVE-2026-27013: Fabric.js Stored XSS Vulnerability via SVG Export
Summary
CVE-2026-27013: Fabric.js Affected by Stored XSS via SVG Export. Affects fabric versions < 7.2.0. Fixed in 7.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fabric.js is a powerful and versatile JavaScript library that enables users to work with HTML5 canvas elements. It provides an interactive object model, allowing for the creation and manipulation of shapes, images, and text. The library is widely used in applications that require rich graphical interfaces, such as design tools and editors. However, a critical vulnerability has been identified that exposes applications using Fabric.js to stored cross-site scripting (XSS) attacks when exporting SVG content.
Vulnerability Detail
The vulnerability arises from the improper handling of user-controlled string values during SVG export. Specifically, Fabric.js applies escaping only to text content but fails to escape other interpolated values in SVG attributes. This allows an attacker to inject arbitrary SVG elements, including malicious event handlers, when user-supplied JSON is loaded and subsequently exported. The vulnerability is particularly dangerous in collaborative applications where users can share or import designs, as it can lead to the execution of arbitrary JavaScript in the victim's browser session.
How To Fix
Minimum fixed version
7.2.0
This is the first release that contains the fix.
npm install fabric@7.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid accepting user-supplied JSON for SVG exports until the library is updated. Additionally, consider sanitizing any user input before processing it with Fabric.js to mitigate potential risks.
Conclusion
The Fabric.js library has a critical vulnerability that allows for stored XSS attacks through improper handling of user-controlled string values during SVG export. It is essential for developers using this library to update to the patched version to protect their applications from potential exploits.
See every vulnerability recorded for fabric →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious SVG elements into exported content.
If your application uses Fabric.js and allows users to load and export designs, it may be susceptible to XSS attacks, potentially compromising user sessions and data.
If your application accepts user-generated JSON and renders SVG content in a browser context, it is likely affected by this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fabric.
