GHSA-gcr2-9v8m-gq45

Suggest an improvement
Source
https://github.com/advisories/GHSA-gcr2-9v8m-gq45
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gcr2-9v8m-gq45/GHSA-gcr2-9v8m-gq45.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gcr2-9v8m-gq45
Aliases
Downstream
Published
2026-09-02T22:44:25Z
Modified
2026-09-10T03:50:54Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
Details

Summary

@dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup.

This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options backgroundColor, fontFamily, and textColor but did not cover rotate. @dicebear/initials has the same gap in its numeric fontSize and fontWeight options.

Impact

Cross-site scripting (CWE-79). When the generated avatar is rendered inline (for example via innerHTML) or served as image/svg+xml and opened directly, injected markup such as an <image onerror> handler runs script in the page's origin.

Exploitation requires the application to pass untrusted input into one of these options:

  • rotate (@dicebear/core)
  • fontSize, fontWeight (@dicebear/initials)

In most integrations these options are set by the developer and only seed is user-controlled, so the vulnerable configuration is uncommon. Applications that use trusted, hardcoded values for these options are not at risk.

Patches

Fixed in @dicebear/core 9.4.3 and @dicebear/initials 9.4.3: the values are now XML-escaped before being written into the SVG, matching the CVE-2026-33311 fix. Upgrade to 9.4.3 or later.

The 5.x through 8.x lines share the same flaw but are end-of-life and will not receive a backport; upgrade to 9.4.3. The 10.x line is not affected.

Workarounds

If you cannot upgrade, coerce the affected options to a number before passing them to createAvatar:

rotate: Number(userInput) || 0,

Credits

Reported by @rz1027.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T22:44:25Z",
    "nvd_published_at": "2026-08-20T21:17:07Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / @dicebear/core

Package

Name
@dicebear/core
View open source insights on deps.dev
Purl
pkg:npm/%40dicebear/core

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.3

Database specific

last_known_affected_version_range 
"<= 9.4.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gcr2-9v8m-gq45/GHSA-gcr2-9v8m-gq45.json"

npm / @dicebear/initials

Package

Name
@dicebear/initials
View open source insights on deps.dev
Purl
pkg:npm/%40dicebear/initials

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.3

Database specific

last_known_affected_version_range 
"<= 9.4.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gcr2-9v8m-gq45/GHSA-gcr2-9v8m-gq45.json"