CVE-2026-19504

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the loadFromJSON method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker may be able to leverage this vulnerability to gain improper access to network resources. Was ZDI-CAN-29318.

• CWE-918

• https://www.zerodayinitiative.com/advisories/ZDI-26-588/

Published

Sep 15, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19499Calling strfmon and strfmon_l in the GNU C Library version 2…7.7
• CVE-2026-1950Delta Electronics AS320T has No checking of the length of t…9.8
• CVE-2026-19500The Entries component in Brainstorm Force SureForms version,…7.5
• CVE-2026-19501CSV export functionality in Brainstorm Force SureForms versi…8.8
• CVE-2026-19502MongoDB SQL Schema Builder CLI records its startup configura…5.5
• CVE-2026-19503MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do …4.8
• CVE-2026-19505Improper cryptographic signature verification in `jst_functi…9.8
• CVE-2026-19506Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-ki…8.1
• CVE-2026-19507Uncontrolled resource consumption in `check.jst` in RDK-B We…7.5
• CVE-2026-19508Heap-based buffer overflow in the multipart form-data parser…9.8
• CVE-2026-19509Improper input validation in `ajaxSet_wireless_network_confi…6.5
• CVE-2026-1951Delta Electronics AS320T has no checking of the length of th…9.8