Fabric.js versions prior to 7.2.0 contain a stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where the library fails to properly escape user-controlled strings during SVG export. Unauthenticated attackers can inject malicious payloads into JSON data, which, when rendered via the toSVG method, execute arbitrary scripts in the context of the victim's session.

The vulnerability poses a significant risk to applications that process user-supplied JSON, such as CMS plugins or collaborative design tools. A successful exploit allows attackers to hijack user sessions, steal sensitive cookies, or perform unauthorized actions on behalf of authenticated users. With a CVSS score of 7.6, the impact on confidentiality and integrity is high, potentially leading to widespread account compromise.

Immediate Action: Update the Fabric.js library to version 7.2.0 or later to ensure proper XML escaping during SVG export.

Proactive Monitoring: Monitor application logs for unusual inputs containing SVG tags or script handlers within JSON payloads used in canvas rendering features.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts script execution and prevents the loading of unauthorized resources to mitigate potential XSS impacts.

Public Exploit Available: Unknown.

Given the prevalence of Fabric.js in web-based graphics applications, administrators should prioritize updating to version 7.2.0 immediately. Failure to patch leaves users susceptible to session hijacking and unauthorized data manipulation, making this an urgent maintenance task for any environment utilizing this library.