By vendor

Fabricjs vulnerabilities

Known CVEs affecting Fabricjs products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-44311MEDIUM 5.4

  Fabric.js, a popular JavaScript library for working with HTML5 canvas, contains a Cross-Site Scripting (XSS) vulnerability in versions before 7.4.0. The issue stems from improper handling of user input when converting gradient objects to SVG format. Specifically, when the toSVG() method processes color values in gradient color stops, it fails to escape special characters. If a web application takes the generated SVG string and inserts it into a webpage, an attacker can craft malicious input that executes arbitrary JavaScript in users' browsers. The vulnerability requires user interaction and affects the integrity and confidentiality of the browser session.