SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Description

SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to createAvatar() and serve the resulting SVG inline or with Content-Type: image/svg+xml.

Recommendation

Update the @dicebear/initials package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 9.0.0, <= 9.4.0

  >= 8.0.0, <= 8.0.2

  >= 7.0.0, <= 7.1.3

  >= 6.0.0, <= 6.1.3

  >= 5.0.0, <= 5.4.3**

• Patched version(s): **9.4.1

  8.0.3

  7.1.4

  6.1.4

  5.4.4**

References

• GHSA-mr9r-mww3-v6gv
• CVE-2026-33311
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core - CVE-2026-33311
• SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() - CVE-2026-33418
• Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - CVE-2026-42037
• Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@dicebear/initials