@fduenascoink/ui-sdk (>=18.0.0, <=18.0.4), @nextorders/avatar (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +2 more potentially affected by CVE-2026-33311 via @dicebear/core (>=9.0.0, <=9.4.0)

@dicebear/core NPM version =9.0.0, =18.0.0, =0.1.0-alpha.1, =0.1.0, =9.0.0, =9.4.0 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARCORE-15746954...

dicebear (>=7.0.0-rc.1, <=7.1.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=7.0.0, <=7.1.3)

@dicebear/core NPM version =7.0.0, =7.0.0-rc.1, =7.1.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

@dicebear/collection (>=9.0.0, <=9.4.0), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +1 more potentially affected by CVE-2026-33311 via @dicebear/initials (>=9.0.0, <=9.4.0)

@dicebear/initials NPM version =9.0.0, =9.0.0, =18.0.0, =9.0.0, =9.4.0 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARINITIALS-15746953...

dicebear (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-33311 via @dicebear/core (>=8.0.0, <=8.0.2)

@dicebear/core NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARCORE-15746954...

Cross-site Scripting (XSS)

Overview @dicebear/core is an An avatar library for designers and developers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized interpolation of user-supplied options in the createAvatar function. An attacker can execute arbitrary scripts in the context ...

dicebear (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-33311 via @dicebear/core (>=8.0.0, <=8.0.2)

@dicebear/core NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

dicebear (>=5.0.6, <=5.4.3) potentially affected by CVE-2026-33311 via @dicebear/core (>=5.0.6, <=5.4.3)

@dicebear/core NPM version =5.0.6, =5.0.6, =5.4.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

@dicebear/collection (>=8.0.0-rc.0, <=8.0.2), dicebear (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-33311 via @dicebear/initials (>=8.0.0, <=8.0.2)

@dicebear/initials NPM version =8.0.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARINITIALS-15746953...

@dicebear/collection (>=7.0.0-rc.1, <=7.1.3), dicebear (>=7.0.0-rc.1, <=7.1.3) potentially affected by CVE-2026-33311 via @dicebear/initials (>=7.0.0, <=7.1.3)

@dicebear/initials NPM version =7.0.0, =7.0.0-rc.1, =7.0.0-rc.1, =7.1.3 Source cves: CVE-2026-33311 Source advisory: OSV:GHSA-MR9R-MWW3-V6GV...

GHSA-MR9R-MWW3-V6GV SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Summary SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting XSS when applications pass untrusted input to createAvatar and serve the resulting SVG inline or...

SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Summary SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting XSS when applications pass untrusted input to createAvatar and serve the resulting SVG inline or...

@dicebear/collection (>=7.0.0-rc.1, <=7.1.3), dicebear (>=7.0.0-rc.1, <=7.1.3) potentially affected by CVE-2026-33311 via @dicebear/initials (>=7.0.0, <=7.1.3)

@dicebear/initials NPM version =7.0.0, =7.0.0-rc.1, =7.0.0-rc.1, =7.1.3 Source cves: CVE-2026-33311 Source advisory: SNYK:JS-DICEBEARINITIALS-15746953...

PT-2026-26477

Name of the Vulnerable Software and Affected Versions DiceBear versions prior to 5.4.4 DiceBear versions 6.1.4 and earlier DiceBear versions 7.1.4 and earlier DiceBear versions 8.0.3 and earlier DiceBear versions 9.4.1 and earlier Description The software does not properly escape SVG attribute...

CVE-2026-29112

The CVE affects @dicebear/converter in DiceBear where the legacy ensureSize() reads width/height from input SVG to size the output canvas. An attacker supplying a crafted SVG with extremely large dimensions (e.g., width="999999999") could trigger uncontrolled memory allocation on the server, caus...

CVE-2026-29112 @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a...

CVE-2026-29112 @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a...

CVE-2026-29112

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a...

DiceBear 安全漏洞

DiceBear is an open-source library for generating random avatars. Versions of DiceBear prior to 9.4.0 contained a security vulnerability. This vulnerability stemmed from the ensureSize function, which read the width and height properties from the input SVG to determine the output canvas size. Thi...

dicebear (>=9.0.0, <=9.3.2) potentially affected by CVE-2026-29112 via @dicebear/converter (>=9.0.0, <=9.3.2)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.3.2 Source cves: CVE-2026-29112 Source advisory: OSV:GHSA-V3R3-4QGC-VW66...

dicebear (>=9.0.0, <=9.3.2) potentially affected by CVE-2026-29112 via @dicebear/converter (>=9.0.0, <=9.3.2)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.3.2 Source cves: CVE-2026-29112 Source advisory: SNYK:JS-DICEBEARCONVERTER-15682416...