CVE-2026-33311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33311
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33311.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33311
Aliases
Related
Published
2026-03-24T13:23:43.289Z
Modified
2026-04-17T00:30:14.928826151Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options
Details

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to createAvatar() and serve the resulting SVG inline or with Content-Type: image/svg+xml. Starting in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, all affected SVG attribute values are properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Some mitigating factors limit vulnerability. Applications that validate input against the library's JSON Schema before passing it to createAvatar() are not affected. The DiceBear CLI validates input via AJV and was not vulnerable. Exploitation requires that an application passes untrusted, unvalidated external input directly as option values.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33311.json"
}
References

Affected packages

Git / github.com/dicebear/dicebear

Affected ranges

Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
e8a60b4611b5738c7f46910f77b97ef1967f32dc
Fixed
e94040c3ca14308431c2904458629fc901dc1676
Database specific 
{
    "versions": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.4.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
fab95bb39447cbc51a6d296e6730d0fc1abb6214
Fixed
22834d6a9d07dd0e3583d702b86f84b45d64bc7e
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.1.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
4e1f6af84fa8417a1b09e1d6f9fb209d8e4c2e42
Fixed
7e9bf0550d69f1e80e3f6123868b7af460d428ca
Database specific 
{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.1.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
218cf2a59086fb512ac9b1bfc498ccb8855f4226
Fixed
65dce7264c16355bc13357706e88e16b7be07b52
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
c9e66450840d4f29faee6362249348bb3d18798b
Fixed
8df173a1da688a94cd405b4c015305fc7d9f1f65
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.1"
        }
    ]
}

Affected versions

v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.2.0
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.3.8
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.1.0
v7.1.1
v7.1.2
v7.1.3
v8.*
v8.0.0
v8.0.1
v8.0.2
v9.*
v9.0.0
v9.0.1
v9.1.0
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4
v9.3.0
v9.3.0-alpha.0
v9.3.0-alpha.1
v9.3.0-alpha.2
v9.3.0-alpha.3
v9.3.1
v9.3.2
v9.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33311.json"