CVE-2026-27013: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27013 is a stored Cross-Site Scripting (XSS) vulnerability in Fabric.js, a JavaScript HTML5 canvas library, caused by insufficient XML escaping during SVG export. The library correctly applies escapeXml() to text content but fails to escape other user-controlled string values (such as id, image src, pattern source URLs, and gradient coordinates) that are interpolated into SVG attribute markup. All versions of the fabric npm package prior to 7.2.0 are affected. The vulnerability was disclosed on February 18, 2026, with a fix released the same day in version 7.2.0. The CVSS v3.1 base score is 6.1 (Medium) per Feedly/NVD, though the GitHub Security Advisory rates it 7.6 (High) (GitHub Advisory, Fabric.js Advisory).

The root cause is improper output encoding (CWE-116) leading to stored XSS (CWE-79). When JSON is loaded via loadFromJSON(), the deserialization path (StaticCanvas.ts → enlivenObjects() → _fromObject() → _setOptions()) assigns all JSON properties — including id — verbatim to fabric objects with no allowlist or sanitization. During SVG export via toSVG(), multiple locations interpolate these user-controlled values directly into SVG attribute markup without escaping: (1) getSvgCommons() in FabricObjectSVGExportMixin.ts interpolates this.id unescaped into an id="..." attribute, affecting all object types (Rect, Circle, Path, Text, Image, Group, etc.); (2) Image._toSVG() interpolates the image source URL unescaped into xlink:href; (3) Pattern.toSVG() interpolates both the pattern id and sourceToString() unescaped; and (4) Gradient.toSVG() interpolates a user-supplied id prefix unescaped. An attacker crafts a malicious JSON payload (e.g., setting id to ">) that, when the application renders the exported SVG in a browser, breaks out of the attribute context and injects arbitrary SVG elements with event handlers (GitHub Advisory, Fabric.js Advisory, Fix Commit).

Successful exploitation enables stored XSS, allowing an attacker to execute arbitrary JavaScript in the victim's browser session. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and exfiltration of sensitive data accessible within the browser context. Applications most at risk include collaborative design tools (e.g., Canva-like platforms), CMS or e-commerce platforms with fabric.js-based editors, and any export-to-SVG workflow where the resulting SVG is rendered in-page, used in email templates, or embedded in other contexts (GitHub Advisory, Fabric.js Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (18th percentile), indicating a low near-term probability of exploitation. However, exploitation requires no privileges and only user interaction (a victim must view the rendered SVG output), making the attack surface broad in applications that accept and display user-supplied canvas JSON (GitHub Advisory).

1. Identify a vulnerable application: Find a web application using fabric.js < 7.2.0 that accepts user-supplied JSON (e.g., via a collaborative canvas sharing feature, import function, or CMS plugin) and renders the toSVG() output in a browser context (SVG preview, in-page embed, or email template).
2. Craft a malicious JSON payload: Construct a fabric.js canvas JSON object with a malicious id property designed to break out of the SVG attribute context. Example:

{
  "objects": [
    {
      "type": "rect",
      "id": "\"><animate onbegin=\"alert(document.cookie)\" attributeName=\"x\" dur=\"1s\" />",
      "width": 100,
      "height": 100,
      "fill": "red"
    }
  ]
}

3. Submit the payload: Upload, share, or save the malicious JSON through the application's normal user interface (e.g., import canvas, share design, save template).
4. Trigger SVG export and rendering: Wait for or induce a victim (or the application itself) to call toSVG() on the canvas loaded with the malicious JSON and render the resulting SVG in a browser context.
5. Achieve XSS execution: The unescaped id value breaks out of the XML attribute, injecting an arbitrary SVG element with an event handler (e.g., onbegin, onload). When the SVG is rendered, the injected JavaScript executes in the victim's browser session, enabling session hijacking, data exfiltration, or further attacks (GitHub Advisory, Fabric.js Advisory).

• Network: Unexpected outbound HTTP requests from a victim's browser to attacker-controlled domains following interaction with an SVG preview or export feature; unusual data exfiltration patterns (e.g., cookies or tokens sent via GET parameters to external URLs).
• Application Logs: Server-side logs showing user-submitted JSON payloads containing suspicious id field values with characters such as ", >, <, or SVG/HTML event handler keywords (onload, onbegin, onerror, alert).
• File System / Storage: Stored canvas JSON objects in databases or file storage containing id, src, or gradient/pattern fields with XML special characters or JavaScript event handler strings.
• Browser / Client-Side: Unexpected JavaScript execution or alert dialogs triggered when viewing SVG exports or previews; browser developer tools showing injected <animate>, <script>, or other SVG elements with event handlers in rendered SVG content (GitHub Advisory).

The primary remediation is to upgrade the fabric npm package to version 7.2.0 or later, which applies escapeXml() to all user-controlled values interpolated into SVG attribute markup across all affected files (Fabric.js Release, Fix Commit). As a defense-in-depth measure prior to patching, applications should sanitize and validate all user-controlled input before passing it to loadFromJSON(), and implement a strict Content Security Policy (CSP) to restrict inline script execution and limit the impact of SVG-based XSS. Additionally, avoid rendering toSVG() output directly in-page without sanitization using a library such as DOMPurify (GitHub Advisory).

The vulnerability was published by fabric.js maintainer asturur on February 18, 2026, and credited to researcher nedlir as the finder. Brief mentions appeared on Mastodon and Bluesky via TheHackerWire shortly after disclosure. Qualys included the vulnerability in their February 2026 application security detections publication, and Red Hat tracked it via their CVE database. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).