ZDI 2026-08-24

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

CVE-2026-19504

Machine-generated analysis · WAYSCloud LLM

Fabric.js's loadFromJSON function can be abused for server-side request forgery, resulting in sensitive data disclosure.

Context

The advisory concerns the Fabric.js JavaScript library. It describes a server-side request forgery vulnerability that may allow remote attackers to disclose sensitive information. Exploitation requires interaction with the library, and the exact attack vector depends on how the library is implemented.

Operator considerations

Check: inventory installations of Fabric.js and verify versions.
Isolate: restrict network access for components that invoke loadFromJSON where possible.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 4.0. The following CVEs are assigned: CVE-2026-19504.

Read the full advisory on ZDI →