Is CVE-2026-27013 actively exploited?

A weaponized exploit exists for CVE-2026-27013, making exploitation likely. It is not yet confirmed in the CISA KEV catalog.

Can CVE-2026-27013 be exploited remotely?

Yes. CVE-2026-27013 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27013?

CVE-2026-27013 has a CVSS score of 7.6 (HIGH) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2026-27013

HIGHWEAPONIZED

CVE-2026-27013

CWE-79Published: February 19, 2026· Updated: Feb 23, 2026

7.6

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.4th

Official Description

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session. Version 7.2.0 contains a fix.

NVD Source

Technical Analysis

CVE-2026-27013 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.6.

A weaponized exploit for CVE-2026-27013 is publicly known. This significantly lowers the barrier for threat actors and increases the urgency for remediation.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.