CVE-2026-68921

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3

Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate() function fails to escape the rotate option. In @dicebear/initials, the fontSize and fontWeight options are emitted without escaping. Although these options use numeric TypeScript types, runtime callers can pass strings to break out of attributes and inject arbitrary SVG markup. This can lead to script execution in the page origin if the generated avatar is inserted inline or served as image/svg+xml and opened directly, provided that an application passes untrusted values into these options.

Recommendations Update @dicebear/core to version 9.4.3. Update @dicebear/initials to version 9.4.3.