Description
@dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup.
Recommendation
Update the @dicebear/initials package to the latest compatible version. Followings are version details:
- Affected version(s): <= 9.4.2
- Patched version(s): 9.4.3
References
Could your website be exposed too?
SmartScanner can check your website for DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials and gives you actionable findings to investigate.
Start a free scanRelated Issues
- DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials - @dicebear/core - CVE-2026-68921
- SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - CVE-2026-33311
- SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core - CVE-2026-33311
- SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() - CVE-2026-33418
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026