@fduenascoink/ui-sdk (>=18.0.0, <=18.0.4), @nextorders/avatar (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +3 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

EUVD-2026-63657

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core and fontSize/fontWeight in @dicebear/initials...

@argustech/agentflow (>=1.0.0, <=1.3.3), @assisly-orgnazation/embed (0.1.0) +37 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.144 and more Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

@fduenascoink/ui-sdk (>=18.0.0, <=18.0.4), @nextorders/avatar (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +3 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: SNYK:JS-DICEBEARCORE-19233389...

Cross-site Scripting (XSS)

Overview @dicebear/core is an An avatar library for designers and developers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were...

@argustech/agentflow (>=1.0.0, <=1.3.3), @assisly-orgnazation/embed (0.1.0) +37 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.144 and more Source cves: CVE-2026-68921 Source advisory: SNYK:JS-DICEBEARINITIALS-19233390...

Cross-site Scripting (XSS)

Overview @dicebear/initials is an Initials avatar style for DiceBear Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were properly...

CVE-2026-68921

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921

In DiceBear versions prior to 9.4.3, @dicebear/core interpolates the rotate option without XML escaping in addRotate (svg.ts), and @dicebear/initials emits fontSize/fontWeight unescaped (index.ts). Runtime callers can pass strings despite numeric types, break out of attributes, and inject arbitra...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

PT-2026-79139

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3 Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate function fails to...

CVE-2026-68921: Improper Neutralization of Input During Web Page Generation

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-33311

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...

CVE-2026-29112

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a...

CVE-2026-33418

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the ensureSize function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafti...

CVE-2026-33311

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...