7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27013

CVE-2026-27013: Fabric.js Affected by Stored XSS via SVG Export

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via loadFromJSON() and later exported via toSVG(), the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via loadFromJSON(), collaborative sharing, import features, CMS plugins) and renders the toSVG() output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session. Version 7.2.0 contains a fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27013

CVE-2026-27013:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fabric	npm	< 7.2.0	7.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the fabric.js library. The root cause is the failure to properly sanitize and escape user-controlled data when exporting a canvas to an SVG format. The primary attack vector starts with the StaticCanvas.loadFromJSON function, which deserializes a JSON object to populate a canvas. This function does not validate or sanitize the incoming data, allowing an attacker to insert malicious strings into various properties of fabric.js objects, such as id, image sources (src), and other attributes.

The actual vulnerability is triggered when the toSVG method (or a related SVG export method like getSvgCommons) is called on the objects. These methods would then interpolate the malicious strings directly into the resulting SVG markup without proper escaping. This allows the attacker's payload to break out of the intended attribute context and inject arbitrary SVG or HTML elements, including <script> tags or event handlers (e.g., onload, onbegin), which execute in the context of the user's browser.

The provided patch addresses this by applying an escapeXml function to all user-controllable properties before they are embedded in the SVG output. The analysis identified the key functions where this lack of escaping occurred, which are the primary vulnerable functions. The loadFromJSON function is also included as it represents the entry point for the malicious data.

Vulnerable functions

StaticCanvas.loadFromJSON

src/canvas/StaticCanvas.ts

This function deserializes a JSON representation of the canvas content. The vulnerability occurs because this function does not sanitize the input values, such as object IDs or other properties, which are later used to construct an SVG document. An attacker can provide a malicious JSON payload to this function, which will then be rendered unsafely by other functions.

FabricObjectSVGExportMixin.getSvgCommons

src/shapes/Object/FabricObjectSVGExportMixin.ts

This function generates common SVG attributes for a fabric object, including the 'id' attribute. The original code directly interpolated the 'this.id' property into the SVG string without any escaping. Since the 'id' can be controlled by an attacker through the JSON loaded via `loadFromJSON`, this allows for the injection of arbitrary attributes and elements into the SVG, leading to XSS.

FabricImage._toSVG

src/shapes/Image.ts

This function is responsible for creating the SVG representation of an Image object. It constructs an '<image>' element and sets the 'xlink:href' attribute using the value from `this.getSrc(true)`. The vulnerability lies in the fact that the source URL was not escaped, allowing an attacker who controls the image source via the input JSON to break out of the attribute and inject malicious SVG content.

Pattern.toSVG

src/Pattern/Pattern.ts

This function generates the SVG for a pattern. It was found to be vulnerable in two places. First, the pattern's 'id' was interpolated directly into the '<pattern>' element's 'id' attribute. Second, the result of `this.sourceToString()` was interpolated into the 'xlink:href' attribute of an '<image>' element. Both of these values can be controlled by an attacker, leading to XSS.

Gradient.toSVG

src/gradient/Gradient.ts

This function creates the SVG definition for a gradient. The 'id' of the gradient, which can be partially controlled by the user, was interpolated into the 'id' attribute of the gradient element without escaping. This could allow an attacker to inject malicious attributes, although the exploitability is limited by a suffix that is appended to the user-supplied ID.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.