Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN632 _____________________________________________________________________ DATE : 15/06/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running fabric (npm) versions up to and including 7.3.1. ===================================================================== https://github.com/fabricjs/fabric.js/security/advisories/GHSA-w22m-hvvm-xmwx _____________________________________________________________________ Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization Moderate asturur published GHSA-w22m-hvvm-xmwx Jun 11, 2026 Package fabric (npm) Affected versions <= 7.3.1 Patched versions None Description Summary A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG elements. If an application renders the generated SVG string into the DOM (e.g., via innerHTML), this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. Details During SVG export, Fabric.js serializes gradient color stops into elements like: However, the color value is inserted into the stop-color attribute without proper escaping of special characters such as ", <, and >. This allows crafted input to break out of the attribute context and inject arbitrary markup. For example: color: 'red">

' may result in:

This breaks the intended SVG structure and introduces executable HTML. PoC (Proof of Concept) Successfully verified on v7.2.0 (current latest version). The following HTML and JavaScript code reproduces the vulnerability. The code constructs a rectangle with a maliciously crafted gradient color stop and exports it to SVG: Fabric.js SVG Export XSS Bypass Test

Fabric.js SVG Export XSS Bypass Test (Gradient Color)

SVG Output Rendering:

Impact This issue can lead to XSS in applications that: Allow user-controlled input in gradient definitions (e.g., color values) Use canvas.toSVG() to export content Insert the resulting SVG string into the DOM without sanitization (e.g., via innerHTML) Successful exploitation may result in the execution of arbitrary JavaScript in the victim's browser, theft of sensitive data, or unauthorized actions on behalf of the user. Suggested Fix Proper Escaping (Recommended): Escape special characters in attribute values during SVG serialization. Severity Moderate 5.4/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE ID CVE-2026-44311 Weaknesses Weakness CWE-79 Weakness CWE-116 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================