Skip to content
OpenAdvisories

Vendor

dicebear

4 known vulnerabilities.

Products

dicebear 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-68921

    DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

    DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials s…

    dicebear dicebear @dicebear/initials @dicebear/core npm
  • Medium 4.7
    CVE-2026-33311

    @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

    DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not …

    dicebear dicebear @dicebear/initials @dicebear/core npm