Skip to content
OpenAdvisories

Vendor

dicebear

4 known vulnerabilities.

Products

dicebear 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-33418

    @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection

    DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of servic…

    dicebear dicebear @dicebear/converter npm
  • High 7.5
    CVE-2026-29112

    @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions

    DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dicebear/converter` read the `width` and `height` attributes from the input SVG to determine the output canvas size for rasterization (PNG, JP…

    dicebear dicebear @dicebear/converter npm