Asturur

**Name of the Vulnerable Software and Affected Versions** Fabric.js versions prior to 7.4.0 **Description** Improper escaping of user-controlled input during SVG serialization via the `toSVG()` method can lead to Cross-Site Scripting (XSS). Specifically, the `color` field within the `colorStops` array of a `fabric.Gradient` object is not properly escaped when converted into SVG `<stop>` elements. This allows an attacker to inject arbitrary HTML or SVG by crafting input that breaks out of the `stop-color` attribute context. If an application renders the resulting SVG string into the DOM, arbitrary JavaScript can be executed in the victim's browser. **Recommendations** Update to version 7.4.0.