CVE-2026-44311

Name of the Vulnerable Software and Affected Versions Fabric.js versions prior to 7.4.0

Description Improper escaping of user-controlled input during SVG serialization via the toSVG() method can lead to Cross-Site Scripting (XSS). Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop> elements. This allows an attacker to inject arbitrary HTML or SVG by crafting input that breaks out of the stop-color attribute context. If an application renders the resulting SVG string into the DOM, arbitrary JavaScript can be executed in the victim's browser.

Recommendations Update to version 7.4.0.