CVE-2026-68921

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68921
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68921.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68921
Aliases
  • GHSA-gcr2-9v8m-gq45
Published
2026-08-20T21:08:43.813Z
Modified
2026-08-23T03:42:53.171339365Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
Details

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3.

Database specific 
{
    "cwe_ids": [
        "CWE-184",
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68921.json"
}
References

Affected packages

Git / github.com/dicebear/dicebear

Affected ranges

Type
GIT
Repo
https://github.com/dicebear/dicebear
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
922946d738c4e77ab6c412e27ede75941fec4b59
Fixed
dc3dc40438791cd0bec9ef50512f2baeed53a633
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.4.3"
        }
    ]
}

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.2.3
1.*
1.0.0
1.0.1
@dicebear/avatars-avataaars-sprites@1.*
@dicebear/avatars-avataaars-sprites@1.0.10
@dicebear/avatars-avataaars-sprites@1.0.2
@dicebear/avatars-avataaars-sprites@1.0.3
@dicebear/avatars-avataaars-sprites@1.0.4
@dicebear/avatars-avataaars-sprites@1.0.5
@dicebear/avatars-avataaars-sprites@1.0.6
@dicebear/avatars-avataaars-sprites@1.0.7
@dicebear/avatars-avataaars-sprites@1.0.8
@dicebear/avatars-avataaars-sprites@1.0.9
@dicebear/avatars-avataaars-sprites@1.1.0
@dicebear/avatars-avataaars-sprites@1.1.1
@dicebear/avatars-avataaars-sprites@1.1.2
@dicebear/avatars-avataaars-sprites@1.1.3
@dicebear/avatars-avataaars-sprites@1.1.4
@dicebear/avatars-avataaars-sprites@1.1.5
@dicebear/avatars-bottts-sprites@1.*
@dicebear/avatars-bottts-sprites@1.0.0
@dicebear/avatars-bottts-sprites@1.1.0
@dicebear/avatars-bottts-sprites@1.1.1
@dicebear/avatars-bottts-sprites@1.1.2
@dicebear/avatars-bottts-sprites@1.1.3
@dicebear/avatars-bottts-sprites@1.1.4
@dicebear/avatars-female-sprites@2.*
@dicebear/avatars-female-sprites@2.0.2
@dicebear/avatars-female-sprites@2.0.3
@dicebear/avatars-female-sprites@2.0.4
@dicebear/avatars-female-sprites@2.0.5
@dicebear/avatars-female-sprites@2.0.6
@dicebear/avatars-female-sprites@2.0.7
@dicebear/avatars-female-sprites@2.1.0
@dicebear/avatars-female-sprites@2.1.1
@dicebear/avatars-female-sprites@2.1.2
@dicebear/avatars-female-sprites@2.1.3
@dicebear/avatars-female-sprites@2.1.4
@dicebear/avatars-gridy-sprites@1.*
@dicebear/avatars-gridy-sprites@1.0.10
@dicebear/avatars-gridy-sprites@1.0.11
@dicebear/avatars-gridy-sprites@1.0.12
@dicebear/avatars-gridy-sprites@1.0.5
@dicebear/avatars-gridy-sprites@1.0.6
@dicebear/avatars-gridy-sprites@1.0.7
@dicebear/avatars-gridy-sprites@1.0.8
@dicebear/avatars-gridy-sprites@1.0.9
@dicebear/avatars-gridy-sprites@1.1.0
@dicebear/avatars-gridy-sprites@1.1.1
@dicebear/avatars-gridy-sprites@1.1.2
@dicebear/avatars-gridy-sprites@1.1.3
@dicebear/avatars-gridy-sprites@1.1.4
@dicebear/avatars-gridy-sprites@1.1.5
@dicebear/avatars-human-sprites@1.*
@dicebear/avatars-human-sprites@1.0.0
@dicebear/avatars-human-sprites@1.0.1
@dicebear/avatars-identicon-sprites@2.*
@dicebear/avatars-identicon-sprites@2.0.2
@dicebear/avatars-identicon-sprites@2.0.3
@dicebear/avatars-identicon-sprites@2.0.4
@dicebear/avatars-identicon-sprites@2.0.5
@dicebear/avatars-identicon-sprites@2.0.6
@dicebear/avatars-identicon-sprites@2.0.7
@dicebear/avatars-identicon-sprites@2.1.0
@dicebear/avatars-identicon-sprites@2.1.1
@dicebear/avatars-identicon-sprites@2.1.2
@dicebear/avatars-identicon-sprites@2.1.3
@dicebear/avatars-identicon-sprites@2.1.4
@dicebear/avatars-initials-sprites@1.*
@dicebear/avatars-initials-sprites@1.0.0
@dicebear/avatars-initials-sprites@1.0.1
@dicebear/avatars-initials-sprites@1.0.2
@dicebear/avatars-initials-sprites@1.0.3
@dicebear/avatars-initials-sprites@1.0.4
@dicebear/avatars-initials-sprites@1.0.5
@dicebear/avatars-initials-sprites@1.0.6
@dicebear/avatars-initials-sprites@1.0.7
@dicebear/avatars-initials-sprites@1.0.8
@dicebear/avatars-initials-sprites@1.0.9
@dicebear/avatars-jdenticon-sprites@1.*
@dicebear/avatars-jdenticon-sprites@1.0.0-alpha.0
@dicebear/avatars-jdenticon-sprites@1.0.1
@dicebear/avatars-jdenticon-sprites@1.0.2
@dicebear/avatars-jdenticon-sprites@1.0.3
@dicebear/avatars-jdenticon-sprites@1.0.4
@dicebear/avatars-jdenticon-sprites@1.1.0
@dicebear/avatars-jdenticon-sprites@1.1.1
@dicebear/avatars-jdenticon-sprites@1.1.2
@dicebear/avatars-jdenticon-sprites@1.1.3
@dicebear/avatars-jdenticon-sprites@1.1.4
@dicebear/avatars-male-sprites@2.*
@dicebear/avatars-male-sprites@2.0.2
@dicebear/avatars-male-sprites@2.0.3
@dicebear/avatars-male-sprites@2.0.4
@dicebear/avatars-male-sprites@2.0.5
@dicebear/avatars-male-sprites@2.0.6
@dicebear/avatars-male-sprites@2.0.7
@dicebear/avatars-male-sprites@2.1.0
@dicebear/avatars-male-sprites@2.1.1
@dicebear/avatars-male-sprites@2.1.2
@dicebear/avatars-male-sprites@2.1.3
@dicebear/avatars-male-sprites@2.1.4
@dicebear/avatars@3.*
@dicebear/avatars@3.0.2
@dicebear/avatars@3.0.3
@dicebear/avatars@3.0.4
@dicebear/avatars@3.0.5
@dicebear/avatars@3.0.6
@dicebear/avatars@3.0.7
@dicebear/avatars@3.1.1
@dicebear/avatars@3.1.2
@dicebear/avatars@3.1.3
@dicebear/avatars@3.1.4
@dicebear/avatars@3.2.0
v0.*
v0.2.4
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v4.*
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.7
v4.0.8
v4.1.0
v4.1.0-alpha.0
v4.1.1
v4.10.0
v4.10.1
v4.10.2
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.6.0
v4.6.0-rc.0
v4.6.0-rc.1
v4.6.0-rc.2
v4.6.0-rc.3
v4.6.0-rc.4
v4.6.1
v4.6.2
v4.7.0
v4.7.0-alpha.0
v4.7.0-alpha.1
v4.7.0-rc.0
v4.7.0-rc.1
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.8.0
v4.8.0-alpha.0
v4.8.0-alpha.1
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.8.5
v4.8.6
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.0.0-alpha.18
v5.0.0-alpha.19
v5.0.0-alpha.20
v5.0.0-alpha.21
v5.0.0-alpha.22
v5.0.0-alpha.23
v5.0.0-alpha.24
v5.0.0-alpha.25
v5.0.0-alpha.26
v5.0.0-alpha.27
v5.0.0-alpha.28
v5.0.0-alpha.29
v5.0.0-alpha.30
v5.0.0-alpha.31
v5.0.0-alpha.32
v5.0.0-alpha.33
v5.0.0-alpha.34
v5.0.0-alpha.35
v5.0.0-alpha.36
v5.0.0-beta.0
v5.0.0-beta.1
v5.0.0-beta.2
v5.0.0-beta.3
v5.0.0-beta.4
v5.0.0-beta.5
v5.0.0-beta.6
v5.0.0-beta.7
v5.0.0-beta.8
v5.0.0-beta.9
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.2.0
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v6.*
v6.0.0
v6.0.0-alpha.0
v6.0.0-alpha.1
v6.0.0-beta.0
v6.0.0-beta.1
v6.0.0-beta.2
v6.0.0-beta.3
v6.0.1
v6.0.2
v6.0.3
v7.*
v7.0.0
v7.0.0-rc.0
v7.0.0-rc.1
v7.0.0-rc.2
v7.0.0-rc.3
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.1.0
v7.1.1
v8.*
v8.0.0
v8.0.1
v8.0.2
v9.*
v9.0.0
v9.0.1
v9.1.0
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4
v9.3.0
v9.3.0-alpha.0
v9.3.0-alpha.1
v9.3.0-alpha.2
v9.3.0-alpha.3
v9.3.1
v9.3.2
v9.4.0
v9.4.1
v9.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68921.json"