Medium
Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Type: advisorySources: OSV
Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44311
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 20:43 UTC · Revision 1
Source evidence
Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
core-osv · Original sourcePublished 22 Jun 2026, 20:50 UTC
Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.
osv:CVE-2026-44311
Complete source record
{
"id": "5eae5652c5fcdf289d5a28a36bc873d60457bbdd36b93497a771f520d7585a22",
"url": "https://osv.dev/vulnerability/CVE-2026-44311",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization",
"summary": "Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.",
"evidence": "osv:CVE-2026-44311",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-44311",
"aliases": [
"CVE-2026-44311",
"GHSA-w22m-hvvm-xmwx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/fabricjs/fabric.js",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ce64f450bad811750cb5a75aa749fc1502c644be"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "ce64f450bad811750cb5a75aa749fc1502c644be"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v740"
}
]
}
}
],
"versions": [
"v731",
"v730",
"v720",
"v710",
"v700",
"v700-rc1",
"v700-beta1",
"v662",
"v661",
"v660",
"v654",
"v653",
"v652",
"v651",
"v650",
"v643",
"v642",
"v641",
"v640",
"v630",
"v620",
"v610",
"v6.0.2",
"v6.0.1",
"v6.0.0-rc5",
"v6.0.0-rc4",
"v6.0.0-rc3",
"v6.0.0-rc2",
"v6.0.0-rc1",
"v6.0.0-beta20",
"v6.0.0-beta19",
"v6.0.0-beta18",
"v6.0.0-beta17",
"v6.0.0-beta16",
"v6.0.0-beta15",
"v6.0.0-beta14",
"v6.0.0-beta13",
"v6.0.0-beta12",
"v6.0.0-beta11",
"v6.0.0-beta10",
"v6.0.0-beta9",
"v6.0.0-beta8",
"v6.0.0-beta7",
"v6.0.0-beta6",
"v6.0.0-beta5",
"v6.0.0-beta4",
"v6.0.0-beta3",
"v6.0.0-beta2",
"v6.0.0-beta1",
"v6.0.0-rc.0",
"v510",
"v500",
"v460",
"v451",
"v4.5.0",
"v4.4.0",
"v4.3.1",
"v4.3.0",
"v4.2.0",
"v4.1.0",
"v4.0.0",
"v4.0.0-rc.1",
"v4.0.0-beta.12",
"v4.0.0-beta.11",
"v4.0.0-beta.10",
"v4.0.0-beta.9",
"v4.0.0-beta.8",
"v4.0.0-beta.7",
"v4.0.0-beta.6",
"4.0.0-beta.5",
"v4.0.0-beta.4",
"v4.0.0-beta.3",
"v4.0.0-beta.2",
"v4.0.0-beta.1",
"v3.6.1",
"v3.6.0",
"v3.5.0",
"v3.4.0",
"3.3.2",
"v3.2.0",
"v3.1.0",
"v3.0.0",
"v2.7.0",
"v2.6.0",
"v2.5.0",
"v2.4.6",
"v2.4.5",
"v2.4.4",
"v2.4.3",
"2.4.2-b",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.4",
"v2.2.3",
"v2.2.2",
"v2.2.1",
"v2.2.0",
"v2.1.0",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc.4",
"v2.0.0-rc.3",
"v2.0.0-rc.2",
"v2.0.0-rc.1",
"v2.0.0-beta.7",
"v2.0.0-beta.6",
"v2.0.0-beta.4",
"v2.0.0-beta.3",
"v2.0.0-beta.1",
"v1.7.6",
"v1.7.5",
"1.7.4",
"v1.7.3",
"v1.7.2",
"v1.7.1",
"1.7.0",
"v1.6.7",
"v1.6.6",
"v1.6.5",
"1.6.4",
"1.6.3",
"1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.0",
"v1.4.13",
"v1.4.12",
"v1.4.11",
"v1.4.10",
"v1.4.9",
"v1.4.8",
"v1.4.7",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.0",
"v1.3.7",
"v1.3.0",
"v1.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44311.json"
}
}
],
"modified": "2026-10-28T02:30:39.224903187Z",
"provider": "osv",
"references": [
"https://github.com/fabricjs/fabric.js/releases/tag/v740",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44311.json",
"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx",
"https://nvd.nist.gov/vuln/detail/CVE-2026-44311"
],
"provider_metadata": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "7.4.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "7.4.0"
},
{
"fixed": "7.4.0"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44311.json"
}
},
"related_cves": [
{
"value": "CVE-2026-44311",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 506811,
"published_at": "2026-06-22T20:50:56.69+00:00"
}