CVE-2026-27013

What it actually does

The flaw is a stored cross-site scripting issue in Fabric.js SVG export. Before Fabric.js 7.2.0, text content is XML-escaped during SVG generation, but other user-controlled string values loaded through loadFromJSON() can be interpolated into SVG attributes without proper escaping. A malicious JSON canvas object can therefore terminate an SVG attribute and inject attacker-controlled SVG markup, including scriptable elements or event-handler attributes. When the resulting toSVG() output is rendered by a browser, arbitrary JavaScript can execute in the viewer’s session.

Why it matters to the business

Applications that let users import, share, collaborate on, preview, embed, email, or download canvas content as SVG can become a vehicle for persistent browser compromise. Successful exploitation can lead to account takeover, session theft, unauthorized actions performed as the victim, data exposure visible to the victim, content tampering, and loss of trust in export or collaboration features. The issue has a high CVSS score but low current EPSS and is not listed in CISA KEV, so it should be prioritized especially where untrusted users can supply Fabric.js JSON that is later rendered as SVG in authenticated browser contexts.

How an attack unfolds

An attacker creates a malicious Fabric.js JSON payload containing crafted string fields that are not XML-escaped during SVG export. The payload is submitted through an application feature such as JSON import, collaborative design sharing, CMS content editing, saved templates, or asset upload. The application stores or processes the JSON and later calls loadFromJSON() followed by toSVG(). Because the affected Fabric.js versions fail to escape certain attribute values, the attacker’s string breaks out of the intended SVG attribute and injects additional SVG markup such as elements with onload, onclick, href, or animation-based script execution. When another user previews, embeds, opens, or views the exported SVG in a browser context, the injected JavaScript executes with the permissions of that web application session.

How to fix it

Upgrade Fabric.js to version 7.2.0 or later wherever Fabric.js JSON can be loaded and exported to SVG. If consuming source directly, ensure the fix corresponding to the Fabric.js SVG attribute escaping change is present; the supplied affected-product metadata references gpg/gnupg and commit 115d138ba599328005c5321c0ef9f00355838ca9, which appears inconsistent with the Fabric.js vulnerability description and should be verified against authoritative package manifests before relying on it. As defense in depth, treat imported canvas JSON as untrusted input, validate or reject unexpected object properties and string fields, sanitize generated SVG with an allowlist-based SVG sanitizer before rendering, render untrusted SVGs in sandboxed iframes without same-origin privileges, serve exported SVGs as downloads rather than inline where feasible, apply a restrictive Content Security Policy that blocks inline script execution, and avoid inserting generated SVG via unsafe DOM APIs.

How to confirm the fix worked

Confirm all deployed applications and build artifacts use Fabric.js 7.2.0 or later, including bundled frontend assets, transitive dependencies, vendored copies, and plugins. Search dependency manifests and lockfiles for fabric or fabric.js versions earlier than 7.2.0. Exercise the vulnerable workflow in a safe test environment by importing a benign attribute-breakout SVG payload through loadFromJSON(), exporting through toSVG(), and verifying that dangerous characters are escaped rather than rendered as new SVG elements or event attributes. Inspect generated SVG output for unescaped attacker-controlled quote characters, angle brackets, event-handler attributes, javascript: URLs, foreignObject elements, or script-capable SVG constructs. Validate that any SVG sanitizer, sandboxing, and CSP controls remain active in preview, export, embed, and email-rendering paths.

Typical attack path

1. Identify an application feature that accepts or stores Fabric.js canvas JSON from users or external sources.
2. Craft a Fabric.js JSON object containing attribute-breaking XML/SVG payloads in user-controlled string fields other than normal text content.
3. Submit or share the malicious JSON through an import, collaboration, template, CMS, or upload workflow.
4. Wait for the application to load the JSON with loadFromJSON() and export it with toSVG().
5. Trigger or wait for a victim to render the generated SVG in a browser context such as an in-page preview, embedded asset, email template, or export viewer.
6. Execute JavaScript in the victim’s browser session to steal tokens, perform actions as the victim, exfiltrate accessible data, or modify application content.

How to detect it

Review application logs, object storage, databases, CMS revisions, uploaded asset repositories, and collaboration history for Fabric.js JSON imports and generated SVG files containing suspicious SVG scripting constructs. Focus on records created before the upgrade to Fabric.js 7.2.0 and on workflows where untrusted users can submit JSON that is later previewed by privileged users. Useful log sources include HTTP access logs for JSON import/upload endpoints, application audit logs for template or design creation, file/object storage access logs for SVG exports, web server logs for served SVG previews, browser security reports or CSP violation reports, and EDR/proxy telemetry showing unusual requests initiated immediately after SVG previews. Look for attribute-breakout sequences such as embedded quotes followed by new SVG elements, event handlers on SVG elements, javascript: URLs, foreignObject usage, base64-encoded payloads, or outbound requests to unfamiliar domains triggered from SVG preview pages. If exploitation is suspected, identify users who viewed the malicious SVG, invalidate sessions or tokens for those users, review account activity after the preview time, and preserve the malicious JSON/SVG artifacts for analysis.

• loadFromJSON
• toSVG
• <script
• </script>
• onload=
• onerror=
• onclick=
• onmouseover=
• onbegin=
• onend=
• javascript:
• <foreignObject
• </foreignObject>
• xlink:href="javascript:
• href="javascript:
• data:text/html
• data:image/svg+xml
• </svg><script
• "><script
• ' onload=
• " onload=
• "><image
• "><animate
• "><foreignObject
• escapeXml
• TextSVGExportMixin.ts

What your security team should do

• Inventory applications, plugins, and frontend bundles that use Fabric.js and specifically identify workflows using loadFromJSON() followed by toSVG().
• Prioritize patching internet-facing, multi-user, collaborative, CMS, design, document-generation, template, or email-rendering applications that accept untrusted canvas JSON.
• Upgrade Fabric.js to 7.2.0 or later and rebuild/redeploy any bundled assets that include the vulnerable library.
• Verify the inconsistent affected-product metadata before tracking remediation against non-Fabric.js packages; use authoritative Fabric.js package data for dependency remediation.
• Add allowlist SVG sanitization and sandboxed rendering for any SVG generated from user-controlled data, even after upgrading.
• Hunt for stored malicious canvas JSON and generated SVGs containing event-handler attributes, javascript: URLs, foreignObject, script tags, or attribute-breakout patterns.
• Add automated tests that import crafted Fabric.js JSON and assert that toSVG() output escapes user-controlled attribute values.
• Review CSP policies for affected applications and reduce the impact of any residual XSS by blocking inline scripts and restricting network exfiltration destinations.