dicebear vulnerabilities

Products

• dicebear 4
• @dicebear/converter 2
• @dicebear/core 2
• @dicebear/initials 2

Latest dicebear CVEs

Newest publication first

1. CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

   Published 2026-08-20

   Medium·CVSS 4.7 EPSS 0.29%

   DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSi...

2. CVE-2026-33418 @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection

   Published 2026-03-24

   High·CVSS 7.5 EPSS 0.39%

   DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the ensureSize() function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size capping could be...

3. CVE-2026-33311 @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

   Published 2026-03-24

   Medium·CVSS 4.7 EPSS 0.19%

   DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpol...

4. CVE-2026-29112 @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions

   Published 2026-03-18

   High·CVSS 7.5 EPSS 0.36%

   DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize() function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.