CVE-2026-44311
Description
Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fabricnpm | < 7.4.0 | 7.4.0 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwxnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-w22m-hvvm-xmwxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-44311ghsaADVISORY
- github.com/fabricjs/fabric.js/releases/tag/v740nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.