Description

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-20T21:17:07.540Z",
  "pubdate": "2026-08-20T21:17:07.540Z",
  "executiveSummary": "A vulnerability exists in @dicebear/core and @dicebear/initials prior to version 9.4.3 involving improper XML escaping. The flaw allows runtime callers to pass arbitrary strings that break out of SVG attributes, resulting in arbitrary SVG markup injection.\nThe primary impact of this vulnerability is potential script execution within the page origin when the generated avatar is rendered inline within a DOM or served directly with an image/svg+xml MIME type and opened in a browser.\nAffected products include DiceBear packages @dicebear/core and @dicebear/initials across versions prior to 9.4.3.\nAttacker capabilities involve injecting arbitrary SVG markup and executing scripts in the context of the vulnerable application's origin, posing significant cross-site scripting (XSS) risks.\nExploitation requires an application to pass untrusted, attacker-controlled values into the avatar generation options, overriding the expected numeric or constrained TypeScript types at runtime.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper XML escaping when interpolating configuration options into SVG attributes. Specifically, the function addRotate in packages/@dicebear/core/src/utils/svg.ts interpolates the rotate option directly into an SVG transform attribute without sanitization. Similarly, @dicebear/initials emits fontSize and fontWeight values without proper escaping in packages/@dicebear/initials/src/index.ts.\nAlthough TypeScript types define these options as numeric, runtime callers can supply arbitrary strings. Because the input is directly concatenated or interpolated into the XML/SVG string structure without validation or context-aware encoding, an attacker can supply specially crafted payloads containing attribute-breaking characters.\nThe attack flow begins when an external application accepts untrusted input from an end-user and passes it directly into the vulnerable DiceBear configuration options. During avatar generation, the unescaped input breaks out of the intended XML attributes (such as transform, font-size, or font-weight) and injects arbitrary SVG elements or event handlers.\nIf the resulting malicious SVG is embedded inline in an HTML document or served directly via the image/svg+xml MIME type and accessed by a victim, the injected payload executes scripts within the security context and origin of the hosting application.\nThe vulnerable components are @dicebear/core prior to version 9.4.3 and @dicebear/initials prior to version 9.4.3. Authentication and privilege requirements depend entirely on the host application handling the untrusted input, while network exposure is determined by how the generated avatars are exposed to end-users."
}