{"id":"EUVD-2026-38399","enisaUuid":"7900f52c-3c09-3a43-9d7c-33f3237e0aa3","description":"Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG \u003cstop\u003e elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim\u0027s browser. This vulnerability is fixed in 7.4.0.","datePublished":"Jun 22, 2026, 8:50:56 PM","dateUpdated":"Jun 23, 2026, 4:13:58 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx\nhttps://github.com/fabricjs/fabric.js/releases/tag/v740\n","aliases":"CVE-2026-44311\nGHSA-w22m-hvvm-xmwx\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"8a4b068c-e9f8-397f-b80c-77c5f5c67f62","product":{"name":"fabric.js","vendor":{"name":"fabricjs"}},"product_version":"\u003c 7.4.0"}],"enisaIdVendor":[{"id":"241f5f14-49e2-3399-817c-f770f92421e0","vendor":{"name":"fabricjs"}}],"enisaIdVulnerability":[{"id":"b3dc6e1e-86fb-361e-9411-f583648800b0","vulnerability":{"id":"CVE-2026-44311","description":"Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG \u003cstop\u003e elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim\u0027s browser. This vulnerability is fixed in 7.4.0.","datePublished":"Jun 22, 2026, 8:50:56 PM","dateUpdated":"Jun 23, 2026, 4:13:58 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx\nhttps://github.com/fabricjs/fabric.js/releases/tag/v740\n","enisa_id":"EUVD-2026-38399\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 5, 2026, 7:18:12 AM","vulnerabilityProduct":[{"id":"c4775639-f73b-36d5-861f-5a2e25381830","product":{"name":"fabric.js","vendor":{"name":"fabricjs"}},"product_version":"\u003c 7.4.0"}],"vulnerabilityVendor":[{"id":"480707f8-aabc-3264-aadb-413e5d19d6d8","vendor":{"name":"fabricjs"}}]}},{"id":"e75040f2-0da3-3f55-a1ac-0f12b5750469","vulnerability":{"id":"GHSA-w22m-hvvm-xmwx","description":"Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization","datePublished":"Jun 12, 2026, 9:00:32 PM","dateUpdated":"Jul 18, 2026, 5:26:21 PM","baseScore":0.0,"references":"https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44311\nhttps://github.com/fabricjs/fabric.js\nhttps://github.com/fabricjs/fabric.js/releases/tag/v740\n","enisa_id":"EUVD-2026-38399\n","aliases":"GHSA-w22m-hvvm-xmwx\nCVE-2026-44311\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}