Fabric.js is a popular JavaScript library for working with HTML5 canvas and SVG. In versions prior to 7.2.0 the function that exports a canvas to SVG performs proper XML escaping only for the text content of shapes. Other string values that become part of the SVG attribute markup are exported without escaping. When attacker‑controlled JSON is loaded through the framework’s loadFromJSON() API and later exported with toSVG(), the unchecked values can break out of XML attributes and inject new elements, including event handlers that execute arbitrary JavaScript. The effect is a fully‑controlled, stored XSS vulnerability that occurs when the exported SVG is rendered in a victim’s browser. An attacker can execute arbitrary code with the privileges of that user, enabling credential theft, session hijacking, or defacement.

Affected vendor is fabricjs for the fabric.js library. All versions before 7.2.0 are vulnerable. Any application that accepts JSON through loadFromJSON() and later renders the resulting SVG – such as collaborative editors, content‑management plugins, or email template generators – is potentially impacted. The repository change addressing the issue is committed in the 7.2.0 release series.

The CVSS score is 7.6 (High), indicating a considerable interaction and the potential for complete compromise of the victim’s browser context. EPSS is reported to be less than 1%, suggesting a low likelihood of exploitation in the wild, although the vulnerability may be actively used in targeted attacks. The flaw is not currently listed in CISA’s KEV catalog. Exploitation requires that an attacker controls the JSON input and that the resulting SVG is rendered in a vulnerable client. The vulnerability is already exploitable in practice as many web applications render SVGs directly on the page, and no user interaction or privileged step is required beyond providing the malicious JSON.