@djangocfg/widget-avatar (>=0.1.1, <=0.1.9), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +5 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =0.1.1, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =0.0.370, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

@argustech/agentflow (>=1.0.0, <=1.4.0), @assisly-orgnazation/embed (0.1.0) +38 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.154 and more Source cves: CVE-2026-68921 Source advisory: GHSA-GCR2-9V8M-GQ45...

EUVD-2026-63657

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core and fontSize/fontWeight in @dicebear/initials...

@argustech/agentflow (>=1.0.0, <=1.4.0), @assisly-orgnazation/embed (0.1.0) +38 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.154 and more Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

@djangocfg/widget-avatar (>=0.1.1, <=0.1.9), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +5 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =0.1.1, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =0.0.370, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: GHSA-GCR2-9V8M-GQ45...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

Cross-site Scripting (XSS)

Overview @dicebear/core is an An avatar library for designers and developers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were...

Cross-site Scripting (XSS)

Overview @dicebear/initials is an Initials avatar style for DiceBear Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were properly...

@djangocfg/widget-avatar (>=0.1.1, <=0.1.9), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +5 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =0.1.1, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =0.0.370, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: SNYK:JS-DICEBEARCORE-19233389...

@argustech/agentflow (>=1.0.0, <=1.4.0), @assisly-orgnazation/embed (0.1.0) +38 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.154 and more Source cves: CVE-2026-68921 Source advisory: SNYK:JS-DICEBEARINITIALS-19233390...

CVE-2026-68921

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921

In DiceBear versions prior to 9.4.3, @dicebear/core interpolates the rotate option without XML escaping in addRotate (svg.ts), and @dicebear/initials emits fontSize/fontWeight unescaped (index.ts). Runtime callers can pass strings despite numeric types, break out of attributes, and inject arbitra...

@djangocfg/widget-avatar (>=0.1.1, <=0.1.9), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +21 more potentially affected by CVE-2026-68921 via @dicebear/core (>=5.0.6, <=9.4.2)

@dicebear/core NPM version =5.0.6, =0.1.1, =18.0.0, =0.6.0-next.1, =1.3.6, =1.5.3, =1.0.6, =0.1.0-alpha.1, =0.0.119, =18.0.0, =0.1.0, =0.0.0-rc.4, =0.0.0-rc.3, =0.0.370, =1.0.0, =5.0.0-alpha.0, =9.4.2 and more Source cves: CVE-2026-68921 Source advisory: MEND:CVE-2026-68921...

CVE-2026-68921

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

@argustech/agentflow (>=1.0.0, <=1.4.0), @assisly-orgnazation/embed (0.1.0) +54 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=5.0.6, <=9.4.2)

@dicebear/initials NPM version =5.0.6, =1.0.0, =5.0.0-alpha.0, =18.0.0, =0.6.0-next.1, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =1.3.6, =1.4.10 and more Source cves: CVE-2026-68921 Source advisory: MEND:CVE-2026-68921...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...

CVE-2026-68921: Improper Neutralization of Input During Web Page Generation

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...