Description
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of the loadFromJSON method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker may be able to leverage this vulnerability to gain improper access to network resources. Was ZDI-CAN-29318.
Published: 2026-09-15
Score: 4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery leading to information disclosure
Action: Apply Patch
AI Analysis

Impact

The loadFromJSON method in Fabric.js fails to validate remote URIs, allowing an attacker to supply a crafted JSON payload that causes the server to request arbitrary network resources. This Server‑Side Request Forgery can expose internal endpoints, leak sensitive data, and potentially lead to further exploitation. The defect is identified as CWE‑918.

Affected Systems

Fabric.js library. Any installation that includes loadFromJSON is affected; version details are not disclosed in the advisory, so all current releases that expose this method should be considered vulnerable.

Risk and Exploitability

The CVSS score is 4.0, indicating moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application to the attack vector is software exploitation via user‑controlled input. Though there are no public exploits reported, the potential for internal network exposure warrants timely mitigation.

Generated by OpenCVE AI on September 20, 2026 at 14:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Fabric.js to the latest version that includes URI validation in loadFromJSON or remove the method from exposed code paths.
  • Restrict the URI schemes accepted by loadFromJSON to only http/https and implement a whitelist of allowed hosts to prevent access to internal resources.
  • Add network controls such as firewall rules or proxy restrictions to block outbound connections from the application to sensitive internal networks, thereby limiting the impact of any remaining SSRF exposure.

Generated by OpenCVE AI on September 20, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the loadFromJSON method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker may be able to leverage this vulnerability to gain improper access to network resources. Was ZDI-CAN-29318.
Title Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability
Weaknesses CWE-918
References
Metrics cvssV3_0

{'score': 4, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2026-09-15T19:20:06.949Z

Reserved: 2026-08-10T19:02:00.188Z

Link: CVE-2026-19504

cve-icon Vulnrichment

Updated: 2026-09-15T19:20:00.939Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T19:17:17.267

Modified: 2026-09-18T19:10:46.443

Link: CVE-2026-19504

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T14:30:18Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)