Executive brief
DiceBear is a popular library for generating customizable avatar SVGs. A cross-site scripting vulnerability allows attackers to inject arbitrary SVG markup (such as onerror handlers) by passing untrusted strings to numeric-typed options like rotate, fontSize, or fontWeight. If the generated avatar is rendered inline on a web page or opened directly, the injected script runs with the page's privileges, potentially enabling session hijacking or data theft. However, exploitation is limited since these options are typically controlled by developers rather than users.
Technical details
The vulnerability is a stored/reflected XSS (CWE-79) in @dicebear/core and @dicebear/initials. The root cause is incomplete input sanitization: numeric options (rotate in @dicebear/core; fontSize and fontWeight in @dicebear/initials) are interpolated into SVG transform and style attributes without XML-escaping. Although these options are typed as numbers in TypeScript, runtime type checking is absent, allowing string values to pass through and break out of their attribute context. An attacker can inject SVG elements like `<image onerror="malicious()">` if the application passes untrusted input to these options. The attack vector is network-based and requires user interaction (rendering the SVG). The vulnerability is fixed in versions 9.4.3+ by XML-escaping all affected values. The 5.x–8.x lines are end-of-life with no backport; version 10.x is unaffected.
Affected products
- DiceBear @dicebear/core <=9.4.2
- DiceBear @dicebear/initials <=9.4.2
Timeline
- 2026-07-05: disclosed: Initial disclosure on GitHub
- 2026-09-02: patched: Fixed in @dicebear/core 9.4.3 and @dicebear/initials 9.4.3
- 2026-09-02: advisory: GHSA-gcr2-9v8m-gq45 published