CVE-2026-68921 in DiceBear
Summary
by MITRE • 08/21/2026
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in DiceBear versions prior to 9.4.3 represents a critical input validation failure within the library's SVG generation logic, specifically affecting the core rendering engine and the initials avatar generator. As an open-source asset widely adopted by designers and developers for generating scalable vector graphics, DiceBear processes various configuration options to construct final image outputs. The security flaw stems from insufficient sanitization of user-supplied data when it is interpolated into XML attributes. In the dicebear/core package, the addRotate utility function takes a rotate option intended for numeric values but fails to apply proper XML escaping before embedding this value into an SVG transform attribute. Similarly, in the dicebear/initials package, the fontSize and fontWeight options are emitted directly without any form of encoding or validation. This lack of rigorous input handling creates a direct pathway for injection attacks if these parameters are derived from untrusted sources rather than hardcoded developer values.
From a technical perspective, this flaw allows an attacker to break out of the intended attribute context by injecting malicious strings that contain special characters such as quotes and angle brackets. Although TypeScript type definitions suggest that numeric types should be enforced at compile time, JavaScript is dynamically typed, allowing runtime callers to pass arbitrary string data despite these static type hints. When a user provides a crafted input like "180 onmouseover=alert(1)", the library inserts this raw text into the SVG markup without escaping it. Consequently, the resulting SVG document contains executable script elements or event handlers that are interpreted by the browser's rendering engine. This behavior aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-Site Scripting (XSS). The vulnerability is particularly dangerous because it occurs in a component often used to display user-generated content, such as profile pictures or initials associated with specific users.
The operational impact of this vulnerability is significant when the generated avatar is rendered inline within an HTML document or served directly as image/svg+xml and opened in a browser. In these scenarios, any script embedded via the injection vector executes with the same origin privileges as the hosting web application. This means that if an attacker can trick a user into viewing a maliciously crafted avatar link or embedding, they can potentially steal session cookies, perform actions on behalf of the victim, or deface the website. The exploitation requires that the target application passes untrusted values directly into these normally developer-controlled options, such as allowing users to customize their display name initials and font size without proper server-side validation. If an application restricts input to safe alphanumeric characters only, the risk is mitigated; however, many implementations fail to enforce strict allowlists on these configuration parameters before passing them to the DiceBear library.
To mitigate this vulnerability, organizations must ensure they upgrade dicebear/core and dicebear/initials to version 9.4.3 or later, where the developers have implemented proper XML escaping for all interpolated values. For applications that cannot immediately update their dependencies due to compatibility constraints, a defensive coding approach is recommended. Developers should implement strict input validation on any user-supplied data before it reaches the avatar generation functions. This includes enforcing allowlists for allowed characters and ensuring that numeric fields strictly contain valid numbers using both client-side checks and server-side parsing. Additionally, applications serving SVG content as image/svg+xml should consider implementing Content Security Policy headers to restrict script execution within those documents, although this is a secondary defense layer rather than a primary fix. The root cause lies in the assumption of trusted input, which must be explicitly rejected or sanitized at the point of entry into the library's processing pipeline.