CVE-2026-44311

What it actually does

CVE-2026-44311 is a stored or reflected cross-site scripting risk in Fabric.js before version 7.4.0. The issue occurs during SVG serialization through the toSVG() method: user-controlled values in the color field of a fabric.Gradient object's colorStops array are inserted into generated SVG <stop> elements without proper escaping. If an application takes that generated SVG string and renders it as active DOM content, an attacker-controlled color value can break out of the expected SVG attribute context and inject arbitrary HTML, SVG, or JavaScript. Successful exploitation executes script in the victim user's browser in the security context of the affected web application, enabling limited confidentiality and integrity impact such as session-context actions, data access visible to the user, or UI manipulation.

Why it matters to the business

Applications that use vulnerable Fabric.js versions to generate SVG from untrusted or user-editable canvas content may expose users to browser-based account abuse, data theft from the application view, unauthorized actions performed as the victim, or phishing within a trusted application page. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV, but the vulnerability is easy to trigger where affected serialization output is inserted into the DOM. Organizations with products that rely on Fabric.js for design tools, document editors, diagramming, image annotation, or user-generated canvas content should treat remediation as important because exploitation can affect end users without compromising the server directly.

How an attack unfolds

An attacker first identifies an application feature that accepts, imports, stores, or shares Fabric.js canvas objects containing gradients. They provide a crafted fabric.Gradient colorStops entry where the color field contains malicious markup or script-bearing SVG/HTML payload content rather than a safe color value. When the application later calls toSVG() on that object, vulnerable Fabric.js versions serialize the malicious value into an SVG <stop> element without sufficient escaping. If the application then injects the resulting SVG string into the page using mechanisms such as innerHTML, DOM insertion, preview rendering, export preview, shared document viewing, or template rendering, the browser parses the attacker's injected content. The payload then executes in the victim's browser when a user views or interacts with the generated SVG, allowing the attacker to run JavaScript as that user within the affected application's origin.

How to fix it

Upgrade Fabric.js to version 7.4.0 or later wherever it is used. If immediate upgrade is not possible, prevent untrusted gradient color values from reaching toSVG() by validating colorStops[].color against a strict allowlist of safe CSS color formats, such as known color names, hex colors, rgb()/rgba() with numeric ranges, or other application-approved values. Do not insert SVG strings generated from untrusted content directly into the DOM using innerHTML or equivalent APIs. Render untrusted SVG in a sandboxed context, serve it as a download with safe content handling, sanitize generated SVG with a robust SVG-aware sanitizer, and enforce a Content Security Policy that blocks inline script execution where feasible. Review dependency lockfiles and bundled frontend artifacts to ensure transitive or vendored copies of Fabric.js are also updated.

How to confirm the fix worked

Confirm dependency manifests, lockfiles, bundled assets, and software composition analysis results show Fabric.js version 7.4.0 or later. Search built JavaScript bundles for Fabric.js version banners or package metadata to identify vendored vulnerable copies. Functionally validate by creating a test canvas object with a gradient color stop containing characters that would normally break an SVG attribute, then call toSVG() and confirm the output safely escapes or rejects the value and does not execute when rendered in the application. Review application code paths that render SVG output and verify untrusted SVG is not assigned to innerHTML, outerHTML, insertAdjacentHTML, document.write, or similar DOM sinks without sanitization. Confirm automated tests cover gradient serialization with malicious color values.

Typical attack path

1. Find a web application that uses Fabric.js before 7.4.0 and supports user-controlled canvas, SVG export, design sharing, template import, or document collaboration.
2. Submit or store a crafted Fabric.js object containing a fabric.Gradient with a malicious colorStops[].color value.
3. Trigger application functionality that calls toSVG() on the attacker-controlled Fabric.js object.
4. Cause the generated SVG string to be rendered into the DOM as active markup rather than treated as inert text or a downloaded file.
5. Execute attacker-controlled JavaScript in the victim's browser when the victim opens, previews, imports, or views the crafted canvas/SVG content.
6. Use the victim's browser session to read accessible page data, perform application actions, alter displayed content, or redirect/phish the user.

How to detect it

Look for evidence that untrusted Fabric.js canvas or SVG content contained malicious gradient color stop values and was later rendered by users. Useful sources include web application request logs, API logs for design/template/import/share endpoints, stored user-generated canvas JSON, exported SVG files, CDN or object-storage access logs for SVG previews, browser telemetry, CSP violation reports, WAF logs, and EDR/browser event data where available. Search for colorStops entries or SVG <stop> elements whose color or stop-color values contain markup delimiters, JavaScript URLs, event-handler attributes, encoded HTML entities, base64 script content, or closing tags. Investigate reports of CSP violations involving inline scripts, blocked javascript: URLs, unexpected SVG script execution, or suspicious redirects immediately after viewing canvas/SVG content. If exploitation is suspected, identify the source document or design object, users who viewed it, downstream exports/previews, and any actions taken by affected user sessions after rendering the content.

• "colorStops"
• "fabric.Gradient"
• "toSVG()"
• "<stop"
• "stop-color="
• "javascript:"
• "onload="
• "onerror="
• "onmouseover="
• "<script"
• "</stop>"
• "</linearGradient>"
• "</radialGradient>"
• "<foreignObject"
• "xlink:href=\"javascript:"
• "href=\"javascript:"
• "&#x3c;script"
• "&lt;script"
• "document.cookie"
• "localStorage"
• "sessionStorage"
• "fetch("
• "XMLHttpRequest"

What your security team should do

• Inventory all applications, frontend bundles, design/editing components, and third-party packages that include Fabric.js.
• Upgrade Fabric.js to 7.4.0 or later and rebuild/redeploy affected frontend assets.
• Prioritize applications that allow users to create, import, store, share, or preview Fabric.js canvas content or SVG exports.
• Add server-side and client-side validation for gradient color stop values and reject non-color markup-like input.
• Review DOM insertion patterns for generated SVG and replace unsafe sinks such as innerHTML with safe rendering or sanitization workflows.
• Deploy or tune Content Security Policy to reduce the impact of injected inline scripts, while not treating CSP as a substitute for patching.
• Search historical logs and stored user-generated design/canvas data for suspicious gradient color values containing markup, event handlers, script URLs, or encoded payloads.
• Add regression tests for Fabric.js SVG serialization and SVG rendering paths to prevent reintroduction of unsafe markup handling.