Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
@dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup. This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options backgroundColor, fontFamily, and textColor but did not cover rotate. @dicebear/initials has the same gap in its numeric fontSize and fontWeight options. Impact Cross-site scripting (CWE-79). When the generated avatar is rendered inline (for example via innerHTML) or served as image/svg+xml and opened directly, injected markup such as an <image onerror handler runs script in the page's origin. Exploitation requires the application to pass untrusted input into one of these options: - rotate (@dicebear/core) - fontSize, fontWeight (@dicebear/initials)…
Recommended action: Upgrade to 9.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to createAvatar() and serve the resulting SVG inline or with Content-Type: image/svg+xml. Affected packages - @dicebear/core — backgroundColor option values interpolated into SVG attributes without escaping (affects solid and gradientLinear background types) - @dicebear/initials — fontFamily and textColor option values interpolated into SVG attributes without escaping Fix All affected SVG attribute values are now properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Mitigating factors - Applications that validate input against the library's JSON Schema before passing it to createAvatar() are not affected - The DiceBear CLI validates input via AJV and was not vulnerable - Exploitation requires that…
Recommended action: Upgrade to 9.4.1, 8.0.3, 7.1.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.