Cross-Site Scripting Vulnerability in Fabric.js by Fabric Development
CVE-2026-44311

5.4MEDIUM

Key Information:

Vendor

Fabricjs

Status
Fabric.js
Vendor
CVE Published:
22 June 2026

What is CVE-2026-44311?

Fabric.js, a popular JavaScript library for HTML5 canvas, has a vulnerability that manifests through improper sanitization of user input during SVG serialization in versions before 7.4.0. Specifically, the color field within the colorStops array of a fabric.Gradient object lacks adequate escaping when it is converted into SVG elements. This flaw can lead to the injection of arbitrary HTML or SVG, potentially allowing execution of malicious JavaScript in a user's browser upon rendering the SVG. This vulnerability has been remedied in version 7.4.0, and users are advised to upgrade to mitigate risks.

Affected Version(s)

fabric.js < 7.4.0

References

https://github.com/fabricjs/fabric.js/security/advisories...
x_refsource_CONFIRM
https://github.com/fabricjs/fabric.js/releases/tag/v740
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.