PT-2026-26477 · Dicebear · Dicebear

Restriction

·

Published

2026-03-19

·

Updated

2026-03-24

·

CVE-2026-33311

CVSS v3.1

4.7

Medium

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions DiceBear versions prior to 5.4.4 DiceBear versions 6.1.4 and earlier DiceBear versions 7.1.4 and earlier DiceBear versions 8.0.3 and earlier DiceBear versions 9.4.1 and earlier
Description The software does not properly escape SVG attribute values derived from user-supplied options such as backgroundColor, fontFamily, and textColor before including them in SVG output. This could lead to Cross-Site Scripting (XSS) if an application passes untrusted input to the createAvatar() function and serves the resulting SVG as image/svg+xml. Applications that validate input against the library’s JSON Schema before passing it to createAvatar() are not affected. The DiceBear CLI, which validates input using AJV, was also not vulnerable. Exploitation requires passing unvalidated external input directly as option values.
Recommendations Versions prior to 5.4.4 should be upgraded to version 5.4.4 or later. Versions 6.1.4 and earlier should be upgraded to version 6.1.4 or later. Versions 7.1.4 and earlier should be upgraded to version 7.1.4 or later. Versions 8.0.3 and earlier should be upgraded to version 8.0.3 or later. Versions 9.4.1 and earlier should be upgraded to version 9.4.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33311
GHSA-MR9R-MWW3-V6GV

Affected Products

Dicebear