The loadFromJSON method in Fabric.js fails to validate remote URIs, allowing an attacker to supply a crafted JSON payload that causes the server to request arbitrary network resources. This Server‑Side Request Forgery can expose internal endpoints, leak sensitive data, and potentially lead to further exploitation. The defect is identified as CWE‑918.

Fabric.js library. Any installation that includes loadFromJSON is affected; version details are not disclosed in the advisory, so all current releases that expose this method should be considered vulnerable.

The CVSS score is 4.0, indicating moderate severity. No EPSS value was published and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application to invoke loadFromJSON with a malicious URI, so the attack vector is software exploitation via user‑controlled input. Though the lack of reported public exploits suggests limited real‑world activity, the potential for internal network exposure warrants timely mitigation.