CVE-2026-44311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44311
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44311.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44311
Aliases
Published
2026-06-22T20:50:56.690Z
Modified
2026-07-15T01:49:20.377185699Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Details

Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Specifically, the color field within the colorStops array of a fabric.Gradient object is not properly escaped when converted into SVG <stop> elements. If an application renders the generated SVG string into the DOM, this may allow an attacker to inject arbitrary HTML/SVG and execute JavaScript in the victim's browser. This vulnerability is fixed in 7.4.0.

Database specific 
{
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44311.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "7.4.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/fabricjs/fabric.js

Affected ranges

Type
GIT
Repo
https://github.com/fabricjs/fabric.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ce64f450bad811750cb5a75aa749fc1502c644be
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.6.2
1.6.3
1.6.4
1.7.0
1.7.4
2.*
2.4.2-b
3.*
3.3.2
4.*
4.0.0-beta.5
v1.*
v1.2.0
v1.3.0
v1.3.7
v1.4.0
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.6.0
v1.6.1
v1.6.5
v1.6.6
v1.6.7
v1.7.1
v1.7.2
v1.7.3
v1.7.5
v1.7.6
v2.*
v2.0.0
v2.0.0-beta.1
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-beta.6
v2.0.0-beta.7
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3
v2.0.0-rc.4
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.6.0
v2.7.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.4.0
v3.5.0
v3.6.0
v3.6.1
v4.*
v4.0.0
v4.0.0-beta.1
v4.0.0-beta.10
v4.0.0-beta.11
v4.0.0-beta.12
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-beta.4
v4.0.0-beta.6
v4.0.0-beta.7
v4.0.0-beta.8
v4.0.0-beta.9
v4.0.0-rc.1
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v4.5.0
Other
v451
v460
v500
v510
v610
v620
v630
v640
v641
v642
v643
v650
v651
v652
v653
v654
v660
v661
v662
v700
v700-beta1
v700-rc1
v710
v720
v730
v731
v6.*
v6.0.0-beta1
v6.0.0-beta10
v6.0.0-beta11
v6.0.0-beta12
v6.0.0-beta13
v6.0.0-beta14
v6.0.0-beta15
v6.0.0-beta16
v6.0.0-beta17
v6.0.0-beta18
v6.0.0-beta19
v6.0.0-beta2
v6.0.0-beta20
v6.0.0-beta3
v6.0.0-beta4
v6.0.0-beta5
v6.0.0-beta6
v6.0.0-beta7
v6.0.0-beta8
v6.0.0-beta9
v6.0.0-rc.0
v6.0.0-rc1
v6.0.0-rc2
v6.0.0-rc3
v6.0.0-rc4
v6.0.0-rc5
v6.0.1
v6.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44311.json"