{ "credits": [ { "type": "finder", "user": { "avatar_url": "https://avatars.githubusercontent.com/u/66902031?v=4", "events_url": "https://api.github.com/users/nedlir/events{/privacy}", "followers_url": "https://api.github.com/users/nedlir/followers", "following_url": "https://api.github.com/users/nedlir/following{/other_user}", "gists_url": "https://api.github.com/users/nedlir/gists{/gist_id}", "gravatar_id": "", "html_url": "https://github.com/nedlir", "id": 66902031, "login": "nedlir", "node_id": "MDQ6VXNlcjY2OTAyMDMx", "organizations_url": "https://api.github.com/users/nedlir/orgs", "received_events_url": "https://api.github.com/users/nedlir/received_events", "repos_url": "https://api.github.com/users/nedlir/repos", "site_admin": false, "starred_url": "https://api.github.com/users/nedlir/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/nedlir/subscriptions", "type": "User", "url": "https://api.github.com/users/nedlir", "user_view_type": "public" } } ], "cve_id": "CVE-2026-27013", "cvss": { "score": 7.6, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.6, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, { "cwe_id": "CWE-116", "name": "Improper Encoding or Escaping of Output" } ], "description": "fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers.\n\n### Deserialization Path (no sanitization)\n\n`loadFromJSON()` (`src/canvas/StaticCanvas.ts:1229`) calls `enlivenObjects()` which calls `_fromObject()` (`src/shapes/Object/Object.ts:1902`). `_fromObject` passes all deserialized properties to the shape constructor via `new this(enlivedObjectOptions)`. The constructor ultimately calls `_setOptions()` (`src/CommonMethods.ts:9`) which iterates over every property and assigns it to the object via `this.set(prop, options[prop])`. There is no allowlist or sanitization - any property in the JSON, including `id`, is set verbatim on the fabric object.\n\n---\n\n### Finding 1: XSS via `id` Property Injection \n\nThe `id` property from deserialized JSON is interpolated directly into SVG attribute strings without escaping.\n\n**Vulnerable code (`src/shapes/Object/FabricObjectSVGExportMixin.ts`, line 89, `getSvgCommons()`):**\n```typescript\ngetSvgCommons(\n this: FabricObjectSVGExportMixin & FabricObject & { id?: string },\n) {\n return [\n this.id ? `id=\"${this.id}\" ` : '', // <-- unescaped, user-controlled\n this.clipPath\n ? `clip-path=\"url(#${...})\" `\n : '',\n ].join('');\n}\n```\n\nThis method is called in `_createBaseSVGMarkup()` (same file, line 178) which wraps every object's SVG output in a `` element. Every fabric object type (Rect, Circle, Path, Text, Image, Group, etc.) inherits this mixin, so the `id` injection vector applies to all object types.\n\n**Contrast with text content, which IS escaped:**\n```typescript\n// src/shapes/Text/TextSVGExportMixin.ts:186\nreturn `${escapeXml(char)}`;\n```\n\nThe inconsistency shows that the intention was to prevent injection but was missed w attribute contexts.\n\n---\n\n### Finding 2: XSS via Image `src` / `xlink:href` Injection \n\nImage source URLs are interpolated raw into `xlink:href` in `_toSVG()`.\n\n**Vulnerable code (`src/shapes/Image.ts`, line 404, `_toSVG()`):**\n```typescript\nimageMarkup.push(\n '\\t`\n// <-- unescaped, returns this.source.src for image sources\n```\n\nAdditionally, Pattern's constructor (`line 92–94`) runs `this.id = uid()` *before* `Object.assign(this, options)`, meaning a user-supplied `id` in the pattern JSON overwrites the auto-generated uid. The pattern `id` is then interpolated unescaped on line 180:\n```typescript\n``\n```\n\n---\n\n### Finding 4: Gradient `id` Partial Injection (lower Severity)\n\n**Vulnerable code (`src/gradient/Gradient.ts`, line 212, `toSVG()`):**\n```typescript\n`id=\"SVGID_${this.id}\"` // <-- unescaped\n```\n\nGradient's constructor (`line 125`) computes `id: id ? `${id}_${uid()}` : uid()`. If a user-supplied `id` is present in the gradient JSON, it is prepended to the auto-generated uid. The user-controlled portion is interpolated unescaped into the SVG. This is exploitable but the payload is constrained by the `_` suffix appended after it.\n\n---\n\n## Impact\n\nAny application that:\n1. Accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins), AND\n2. Renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed)\n\n...is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session.\n\nReal-world attack scenarios:\n- Collaborative design tools (Canva-like apps) where users share canvas state as JSON\n- CMS or e-commerce platforms with fabric.js-based editors that store/render designs\n- Any export-to-SVG workflow where the SVG is later displayed in a browser\n\n---\n\n## Remediation\n\nUpdate to [fabric.js 7.2.0](https://github.com/fabricjs/fabric.js/releases/tag/v720) or newer version. \n\n---\n\n## Confirmed Affected Files\n\n| File | Issue | Method | Exploitable |\n|---|---|---|---|\n| `src/shapes/Object/FabricObjectSVGExportMixin.ts` | Unescaped `this.id` in attribute | `getSvgCommons()` | Yes - primary vector, all object types |\n| `src/shapes/Image.ts` | Unescaped `getSvgSrc()` in `xlink:href` | `_toSVG()` | Yes |\n| `src/Pattern/Pattern.ts` | Unescaped `sourceToString()` in `xlink:href`; unescaped `id` in attribute | `toSVG()` | Yes |\n| `src/gradient/Gradient.ts` | User-supplied `id` prefix interpolated unescaped | `toSVG()` | Yes (partial - uid suffix appended) |", "ghsa_id": "GHSA-hfvx-25r5-qc3w", "github_reviewed_at": "2026-02-18T22:44:58Z", "html_url": "https://github.com/advisories/GHSA-hfvx-25r5-qc3w", "identifiers": [ { "type": "GHSA", "value": "GHSA-hfvx-25r5-qc3w" }, { "type": "CVE", "value": "CVE-2026-27013" } ], "nvd_published_at": null, "published_at": "2026-02-18T22:44:58Z", "references": [ "https://github.com/fabricjs/fabric.js/security/advisories/GHSA-hfvx-25r5-qc3w", "https://github.com/fabricjs/fabric.js/commit/7e1a122defd8feefe4eb7eaf0c180d7b0aeb6fee", "https://github.com/fabricjs/fabric.js/releases/tag/v720", "https://github.com/advisories/GHSA-hfvx-25r5-qc3w" ], "repository_advisory_url": "https://api.github.com/repos/fabricjs/fabric.js/security-advisories/GHSA-hfvx-25r5-qc3w", "severity": "high", "source_code_location": "https://github.com/fabricjs/fabric.js", "summary": "Fabric.js Affected by Stored XSS via SVG Export", "type": "reviewed", "updated_at": "2026-02-18T22:45:02Z", "url": "https://api.github.com/advisories/GHSA-hfvx-25r5-qc3w", "vulnerabilities": [ { "first_patched_version": "7.2.0", "package": { "ecosystem": "npm", "name": "fabric" }, "vulnerable_functions": [], "vulnerable_version_range": "< 7.2.0" } ], "withdrawn_at": null }