Threat Advisory

DiceBear Flaw Injects Arbitrary SVG Markup via Unescaped Rotate Option

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: Medium
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in @dicebear/core and @dicebear/initials due to unescaped rotate option and fontSize/fontWeight options respectively. These flaws allow for cross-site scripting (CWE-79) when the generated avatar is rendered inline or served as image/svg+xml. The overall risk/impact is medium, with affected version range(s) being <= 9.4.2.

CVE-2026-68921 (CVSS 4.7 — Severity): An attacker can inject arbitrary SVG markup via unescaped numeric rotate option in @dicebear/core. This requires the application to pass untrusted input into this option, which is uncommon as these options are typically set by developers using trusted values.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in @dicebear/core and @dicebear/initials due to unescaped rotate option and fontSize/fontWeight options respectively. These flaws allow for cross-site scripting (CWE-79) when the generated avatar is rendered inline or served as image/svg+xml. The overall risk/impact is medium, with affected version range(s) being <= 9.4.2.

CVE-2026-68921 (CVSS 4.7 — Severity): An attacker can inject arbitrary SVG markup via unescaped numeric rotate option in @dicebear/core. This requires the application to pass untrusted input into this option, which is uncommon as these options are typically set by developers using trusted values.[emaillocker id="1283"]

CVE-2026-33311, which escaped the string options `backgroundColor`, `fontFamily`, and `textColor` but did not cover `rotate`.

These vulnerabilities collectively present a medium risk for applications that use user-controlled input for these options.

RECOMMENDATIONS:

  • We recommend you to update @dicebear/core to version 9.4.3.
  • We recommend you to update @dicebear/initials to version 9.4.3.

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu