Multiple security vulnerabilities have been identified in @dicebear/core and @dicebear/initials due to unescaped rotate option and fontSize/fontWeight options respectively. These flaws allow for cross-site scripting (CWE-79) when the generated avatar is rendered inline or served as image/svg+xml. The overall risk/impact is medium, with affected version range(s) being <= 9.4.2.
CVE-2026-68921 (CVSS 4.7 — Severity): An attacker can inject arbitrary SVG markup via unescaped numeric rotate option in @dicebear/core. This requires the application to pass untrusted input into this option, which is uncommon as these options are typically set by developers using trusted values.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in @dicebear/core and @dicebear/initials due to unescaped rotate option and fontSize/fontWeight options respectively. These flaws allow for cross-site scripting (CWE-79) when the generated avatar is rendered inline or served as image/svg+xml. The overall risk/impact is medium, with affected version range(s) being <= 9.4.2.
CVE-2026-68921 (CVSS 4.7 — Severity): An attacker can inject arbitrary SVG markup via unescaped numeric rotate option in @dicebear/core. This requires the application to pass untrusted input into this option, which is uncommon as these options are typically set by developers using trusted values.[emaillocker id="1283"]
CVE-2026-33311, which escaped the string options `backgroundColor`, `fontFamily`, and `textColor` but did not cover `rotate`.
These vulnerabilities collectively present a medium risk for applications that use user-controlled input for these options.
The following reports contain further technical details:
[/emaillocker]