CVE-2026-33311 @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...

CVE-2026-33311

DiceBear CVE-2026-33311 affects @dicebear/core and related packages. The issue: SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output in versions up to 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1. This ...

CVE-2026-33311 @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...

CVE-2026-33311 @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...

DiceBear 安全漏洞

DiceBear is an open-source random avatar generation library developed by DiceBear. Versions prior to DiceBear 9.4.2 contained security vulnerabilities. These vulnerabilities stemmed from the regular expression-based SVG attribute rewriting logic in the ensureSize function, which could be exploite...

DiceBear 跨站脚本漏洞

DiceBear is an open-source random avatar generation library developed by DiceBear. Versions of DiceBear from 5.0.0 to 5.4.4, as well as versions before 6.1.4, 7.1.4, 8.0.3, and 9.4.1, contained a cross-site scripting vulnerability. This vulnerability occurred because SVG attribute values provided...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: SNYK:JS-DICEBEARCONVERTER-15746952...

Allocation of Resources Without Limits or Throttling

Overview @dicebear/converter is a SVG Converter for DiceBear Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ensureSize function. An attacker can cause excessive memory allocation and application crashes by injecting specially craft...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: OSV:GHSA-7J2X-32W6-P43P...

dicebear (>=6.0.0-alpha.0, <=6.1.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=6.0.0, <=6.1.3)

@dicebear/core NPM version =6.0.0, =6.0.0-alpha.0, =6.1.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

@fduenascoink/ui-sdk (>=18.0.0, <=18.0.4), @nextorders/avatar (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +2 more potentially affected by CVE-2026-33311 via @dicebear/core (>=9.0.0, <=9.4.0)

@dicebear/core NPM version =9.0.0, =18.0.0, =0.1.0-alpha.1, =0.1.0, =9.0.0, =9.4.0 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

dicebear (>=5.0.6, <=5.4.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=5.0.6, <=5.4.3)

@dicebear/core NPM version =5.0.6, =5.0.6, =5.4.3 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARCORE-15746954...

@dicebear/collection (>=8.0.0-rc.0, <=8.0.2), dicebear (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-33311 via @dicebear/initials (>=8.0.0, <=8.0.2)

@dicebear/initials NPM version =8.0.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

@dicebear/collection (>=6.0.0-alpha.0, <=6.1.3), dicebear (>=6.0.0-alpha.0, <=6.1.3) potentially affected by CVE-2026-33311 via @dicebear/initials (>=6.0.0, <=6.1.3)

@dicebear/initials NPM version =6.0.0, =6.0.0-alpha.0, =6.0.0-alpha.0, =6.1.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

@dicebear/collection (>=5.0.6, <=5.4.3), dicebear (>=5.0.6, <=5.4.3) potentially affected by CVE-2026-33311 via @dicebear/initials (>=5.0.6, <=5.4.3)

@dicebear/initials NPM version =5.0.6, =5.0.6, =5.0.6, =5.4.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

dicebear (>=6.0.0-alpha.0, <=6.1.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=6.0.0, <=6.1.3)

@dicebear/core NPM version =6.0.0, =6.0.0-alpha.0, =6.1.3 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARCORE-15746954...

dicebear (>=7.0.0-rc.1, <=7.1.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=7.0.0, <=7.1.3)

@dicebear/core NPM version =7.0.0, =7.0.0-rc.1, =7.1.3 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARCORE-15746954...

@dicebear/collection (>=6.0.0-alpha.0, <=6.1.3), dicebear (>=6.0.0-alpha.0, <=6.1.3) potentially affected by CVE-2026-33311 via @dicebear/initials (>=6.0.0, <=6.1.3)

@dicebear/initials NPM version =6.0.0, =6.0.0-alpha.0, =6.0.0-alpha.0, =6.1.3 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARINITIALS-15746953...

GHSA-MR9R-MWW3-V6GV SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Summary SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting XSS when applications pass untrusted input to createAvatar and serve the resulting SVG inline or...

SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Summary SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting XSS when applications pass untrusted input to createAvatar and serve the resulting SVG inline or...