@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection

Vulnerability

Description

DiceBear's @dicebear/converter package (versions prior to 9.4.2) contains a denial-of-service vulnerability in the ensureSize() function. The function attempted to cap SVG width and height attributes at 2048 pixels using a non-global regex with String.prototype.replace(). This regex approach is easily fooled: it matches the first occurrence of <svg in the input, which may be inside an XML comment, a string literal, or other non-element construct rather than the actual root `` element [1][2].

Exploitation

Attack Surface

An attacker can supply a crafted SVG string containing a decoy <svg tag (for example, embedded in an XML comment) before the real SVG root element. When the regex matches the decoy, the real root element's dimensions remain unchanged. During conversion (e.g., toPng, toJpeg, toWebp or toAvif on the Node.js code path), the SVG is rendered by @resvg/resvg-js via renderAsync without a fitTo constraint [1][2]. Because the rendering engine obeys the attacker-specified dimensions, it may allocate gigabytes of memory, leading to an out-of-memory crash. The browser code path is not affected because it uses the clamped return value from ensureSize() directly for canvas dimensions [2].

Impact

Successful exploitation causes a denial of service through excessive memory consumption. There is no data disclosure or integrity impact; availability is solely affected [1][2]. Any application that passes untrusted SVG content to @dicebear/converter's Node.js conversion functions is vulnerable, even outside the DiceBear avatar generation context [2].

Mitigation

Version 9.4.2 eliminates the vulnerability by replacing the regex-based approach with XML-aware parsing using fast-xml-parser to reliably identify and modify the root ` element's attributes. Additionally, a fitTo constraint has been added to the renderAsync` call as defense-in-depth, ensuring rendered output is always bounded [1][2].