CVE-2026-44311 Details
Description
Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop> elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.
A Cross-Site Scripting (XSS) vulnerability has been identified in Fabric.js versions prior to 7.4.0. The issue arises from improper escaping of user-controlled input during SVG serialization with the toSVG() method. Specifically, the color field in the colorStops array of a fabric.Gradient object is not correctly escaped when converted into SVG <stop> elements. If an application renders the resulting SVG string into the DOM, it could allow an attacker to inject arbitrary HTML or SVG and execute JavaScript in the user's browser.
Users can upgrade to Fabric.js version 7.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/fabricjs/fabric.js/releases/tag/v740 | [email protected] | ProductRelease Notes |
| https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fabricjs fabric.js | < 7.4.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |