Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop elements. If an application renders the generated SVG string into the DOM (e.g., via innerHTML), this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. Details During SVG export, Fabric.js serializes gradient color stops into <stop elements like: However, the color value is inserted into the stop-color attribute without proper escaping of special characters such as ", <, and . This allows crafted input to break out of the attribute context and inject arbitrary markup. For example: may result in: This breaks the intended SVG structure and introduces executable HTML. PoC (Proof of Concept) Successfully verified on v7.2.0…
Recommended action: Upgrade to 7.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via loadFromJSON() and later exported via toSVG(), the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Deserialization Path (no sanitization) loadFromJSON() (src/canvas/StaticCanvas.ts:1229) calls enlivenObjects() which calls fromObject() (src/shapes/Object/Object.ts:1902). fromObject passes all deserialized properties to the shape constructor via new this(enlivedObjectOptions). The constructor ultimately calls setOptions() (src/CommonMethods.ts:9) which iterates over every property and assigns it to the object via this.set(prop, options[prop]). There is no allowlist or sanitization - any property in the JSON, including id, is set verbatim on the fabric object. --- Finding…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.