GHSA-w22m-hvvm-xmwx
Medium · 5.4CVSS
5.4
EPSS
—
Published
Jun 12, 2026
CISA due date
—
The record
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fabric | 0 | 7.4.0 |
Related vulnerabilities
- CVE-2026-44311 Fabric.js is a Javascript HTML5 canvas library. Same vulnerability
- CVE-2026-27013 Fabric.js is a Javascript HTML5 canvas library. Also affects fabric
- GHSA-hfvx-25r5-qc3w Fabric.js Affected by Stored XSS via SVG Export Also affects fabric
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116
- CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. CWE-116