CVE-2026-27013

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session. Version 7.2.0 contains a fix.

• CWE-79
• CWE-116
• CWE-79

• https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6feePatch
• https://github.com/fabricjs/fabric.js/releases/tag/v720Product, Release Notes
• https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3wExploit, Patch, Vendor Advisory

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27005Chartbrew is an open-source web application that can connect…9.8
• CVE-2026-27007OpenClaw is a personal AI assistant. Prior to version 2026.2…3.3
• CVE-2026-27008OpenClaw is a personal AI assistant. Prior to version 2026.2…6.7
• CVE-2026-27009OpenClaw is a personal AI assistant. Prior to version 2026.2…5.8
• CVE-2026-2701Authenticated user can upload a malicious file to the server…8.8
• CVE-2026-27012OpenSTAManager is an open source management software for tec…9.8
• CVE-2026-27014NanaZip is an open source file archive Starting in version 5…5.5
• CVE-2026-27015FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-27016LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.4
• CVE-2026-27017uTLS is a fork of crypto/tls, created to customize ClientHel…5.3
• CVE-2026-27018Gotenberg is an API for converting document formats. Prior t…7.5
• CVE-2026-2702A security flaw has been discovered in Beetel 777VR1 up to 0…3.1