2vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate2 (100.0%)
- Low0 (0.0%)
dicebear-initials
Ecosystem: npm
Downloads: 911.89 K
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 6 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting dicebear-initials, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-gcr2-9v8m-gq45 | Moderate | DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)## Summary `@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolated into an SVG `transform` attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup. This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options `backgroundColor`, `fontFamily`, and `textColor` but did not cover `rotate`. `@dicebear/initials` has the same gap in its numeric `fontSize` and |
| GitHub (opens in a new tab) | |
| GHSA-mr9r-mww3-v6gv | Moderate | SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials## Summary SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. ## Affected packages - **`@dicebear/core`** — `backgroundColor` option values interpolated into SVG attributes without escaping (affects `solid` and `gradientLinear` background types) - **`@dicebear/initials`** — `fontFamily` and `textColor` optio |
| GitHub (opens in a new tab) |
- GHSA-gcr2-9v8m-gq45ModerateDiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
< 9.4.3
## Summary `@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolated into an SVG `transform` attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup. This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options `backgroundColor`, `fontFamily`, and `textColor` but did not cover `rotate`. `@dicebear/initials` has the same gap in its numeric `fontSize` and
CVE: CVE-2026-68921
- GHSA-mr9r-mww3-v6gvModerateSVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
>= 5.0.0, < 5.4.4>= 6.0.0, < 6.1.4- +3 more
Affected versions:>= 5.0.0, < 5.4.4>= 6.0.0, < 6.1.4>= 7.0.0, < 7.1.4>= 8.0.0, < 8.0.3>= 9.0.0, < 9.4.1
## Summary SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. ## Affected packages - **`@dicebear/core`** — `backgroundColor` option values interpolated into SVG attributes without escaping (affects `solid` and `gradientLinear` background types) - **`@dicebear/initials`** — `fontFamily` and `textColor` optio
CVE: CVE-2026-33311