CVE-2026-44311: Fabric.js Gradient ColorStop XSS Vulnerability
Summary
CVE-2026-44311: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization. Affects fabric versions < 7.4.0. Fixed in 7.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fabric.js is a powerful and versatile JavaScript library that enables developers to work with HTML5 canvas elements. It provides a range of features for creating and manipulating complex graphics, including shapes, images, and text. One of its key attributes is the ability to create gradients, which enhance the visual appeal of canvas elements. However, a vulnerability has been identified in the way Fabric.js handles gradient color stops during SVG serialization, potentially exposing applications to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input in the color field of the colorStops array within a fabric.Gradient object. When the toSVG() method is called, the color value is inserted into the stop-color attribute without escaping special characters like '"', '<', and '>'. This flaw allows attackers to inject arbitrary HTML/SVG into the generated SVG string, which can be executed in the victim's browser if rendered directly into the DOM. This vulnerability can lead to unauthorized actions, data theft, or other malicious activities.
How To Fix
Minimum fixed version
7.4.0
This is the first release that contains the fix.
npm install fabric@7.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid rendering SVG output directly into the DOM using innerHTML. Instead, consider using a safer method to insert SVG content, such as creating SVG elements programmatically or sanitizing the SVG string before rendering.
Conclusion
The vulnerability identified as CVE-2026-44311 in Fabric.js poses a significant risk due to improper handling of gradient color stops during SVG serialization, leading to potential XSS attacks. It is crucial for developers using Fabric.js to update to version 7.4.0 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for fabric →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
The vulnerability affects Fabric.js versions prior to 7.4.0. Users are advised to upgrade to this version or later.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time. You can also check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to XSS attacks, allowing attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to data theft or unauthorized actions.
Yes, you can sanitize SVG output by using libraries such as DOMPurify, which helps to clean up potentially harmful content before rendering it in the DOM.
References
Related vulnerabilities
Recent vulnerabilities recorded for fabric.
