CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Impact
## Summary SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. ## Affected packages - **`@dicebear/core`** — `backgroundColor` option values interpolated into SVG attributes without escaping (affects `solid` and `gradientLinear` background types) - **`@dicebear/initials`** — `fontFamily` and `textColor` option values interpolated into SVG attributes without escaping ## Fix All affected SVG attribute values are now properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. ## Mitigating factors - Applications that validate input against the library's JSON Schema before passing it to `createAvatar()` are not affected - The DiceBear CLI validates input via AJV and was not vulnerable - Exploitation requires that an application passes untrusted, unvalidated external input directly as option values
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @dicebear/core | >= 5.0.0, <= 5.4.3 | 5.4.4 |
| npm | @dicebear/initials | >= 5.0.0, <= 5.4.3 | 5.4.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dicebear | Dicebear | from 5.0.0 before 5.4.4 from 6.0.0 before 6.1.4 from 7.0.0 before 7.1.4 from 8.0.0 before 8.0.3 from 9.0.0 before 9.4.1 |