@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options
Description
DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to createAvatar() and serve the resulting SVG inline or with Content-Type: image/svg+xml. Starting in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, all affected SVG attribute values are properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Some mitigating factors limit vulnerability. Applications that validate input against the library's JSON Schema before passing it to createAvatar() are not affected. The DiceBear CLI validates input via AJV and was not vulnerable. Exploitation requires that an application passes untrusted, unvalidated external input directly as option values.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
DiceBear avatar library unsafely interpolates user-supplied SVG attributes without XML escaping, enabling stored XSS when untrusted input is passed to createAvatar().
Vulnerability
Description
The vulnerability lies in DiceBear's handling of user-supplied options (backgroundColor, fontFamily, textColor) when generating SVG avatars. Prior to patched versions, these attribute values were not XML-escaped before being interpolated into the SVG output. This allows an attacker to inject arbitrary SVG content, leading to Cross-Site Scripting (XSS) [1][3].
Exploitation
Exploitation requires that an application passes untrusted, unvalidated external input directly to createAvatar() as option values. The resulting SVG must be served inline or with Content-Type: image/svg+xml. Notably, applications that validate input against the library's JSON Schema before passing it to createAvatar() are not affected. The DiceBear CLI, which validates input via AJV, was also not vulnerable [1][3].
Impact
If successfully exploited, an attacker can execute arbitrary scripts in the context of a victim's browser when they view the generated avatar. This could lead to session hijacking, data theft, or other malicious actions [1].
Mitigation
DiceBear has released patches in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1. Users should upgrade to the latest patched version appropriate for their branch. As a workaround, applications should validate input against the JSON Schema before passing it to createAvatar() [1][3].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@dicebear/corenpm | >= 5.0.0, < 5.4.4 | 5.4.4 |
@dicebear/corenpm | >= 6.0.0, < 6.1.4 | 6.1.4 |
@dicebear/corenpm | >= 7.0.0, < 7.1.4 | 7.1.4 |
@dicebear/corenpm | >= 8.0.0, < 8.0.3 | 8.0.3 |
@dicebear/corenpm | >= 9.0.0, < 9.4.1 | 9.4.1 |
@dicebear/initialsnpm | >= 5.0.0, < 5.4.4 | 5.4.4 |
@dicebear/initialsnpm | >= 6.0.0, < 6.1.4 | 6.1.4 |
@dicebear/initialsnpm | >= 7.0.0, < 7.1.4 | 7.1.4 |
@dicebear/initialsnpm | >= 8.0.0, < 8.0.3 | 8.0.3 |
@dicebear/initialsnpm | >= 9.0.0, < 9.4.1 | 9.4.1 |
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-mr9r-mww3-v6gvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33311ghsaADVISORY
- github.com/dicebear/dicebear/security/advisories/GHSA-mr9r-mww3-v6gvghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.