EUVD-2026-63657

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core and fontSize/fontWeight in @dicebear/initials...

CVE-2026-68921

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...