Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. Starting in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, all affected SVG attribute values are properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Some mitigating factors limit vulnerability. Applications that validate input against the library's JSON Schema before passing it to `createAvatar()` are not affected. The DiceBear CLI validates input via AJV and was not vulnerable. Exploitation requires that an application passes untrusted, unvalidated external input directly as option values.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-24 | 2 | Disclosure1General1 |
| 2026-09-03 | 1 | Disclosure1 |
🟠 @dicebear/core & @dicebear/initials, SVG Injection / XSS, #CVE-2026-33311 (Medium) -DC-Sep2026-2132 https://dailycve.com/dicebear-core-dicebear-initials-svg-injection-xss-cve-2026-33311-medium-dc-sep2026-2132/
Post summary
The tweet announces the disclosure of CVE-2026-33311, an SVG injection / XSS vulnerability in dicebear/core and dicebear/initials, with a medium severity rating.
CVE-2026-33311 Cross-Site Scripting in DiceBear Avatar Library Versions 5.0.0 to 9.4.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33311 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE‑2026‑33311, a cross‑site scripting vulnerability affecting DiceBear Avatar Library versions 5.0.0 to 9.4.1, and provides links to a vulnerability details page and a notification.
CVE-2026-33311 DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute value… https://www.cve.org/CVERecord?id=CVE-2026-33311
Post summary
The post notes that CVE‑2026‑33311 impacts certain DiceBear library versions and mentions SVG attribute values, but does not provide evidence of a PoC, exploit, active use, patch, or detailed technical description.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dicebear | dicebear | - | - | - |