DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-68921: CVE-2026-68921: Cross-Site Scripting via SVG Attribute Injection in DiceBear

#security #cve #cybersecurity

CVE-2026-68921: Cross-Site Scripting via SVG Attribute Injection in DiceBear

Vulnerability ID: CVE-2026-68921
CVSS Score: 4.7
Published: 2026-09-02

CVE-2026-68921 is a Cross-Site Scripting (XSS) vulnerability affecting the @dicebear/core and @dicebear/initials packages. The flaw stems from a disconnect between compile-time TypeScript type definitions and runtime JavaScript execution. Unvalidated numeric-typed options can receive raw string payloads at runtime, allowing attackers to escape XML attribute boundaries and inject malicious vector markup, executing arbitrary script code within the user's web origin.

TL;DR

A runtime type bypass in @dicebear/core and @dicebear/initials allows unescaped string payloads to be processed in place of numeric parameters, causing structural breakout in the generated SVG and enabling stored cross-site scripting.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.7 (Medium)
  • EPSS Score: 0.00222
  • Impact: Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept (PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • @dicebear/core
  • @dicebear/initials
  • @dicebear/core: < 9.4.3 (Fixed in: 9.4.3)
  • @dicebear/initials: < 9.4.3 (Fixed in: 9.4.3)

Code Analysis

Commit: 922946d

Enforce XML escaping of numeric parameters to prevent attribute breakout and cross-site scripting.

Exploit Details

  • GitHub Security Advisory: Proof of concept and technical description detailing attribute breakouts on rotate, fontSize, and fontWeight.

Mitigation Strategies

  • Upgrade @dicebear/core and @dicebear/initials to version 9.4.3 or above.
  • Enforce strict runtime schema validation of all API inputs.
  • Apply rigid Content Security Policy (CSP) rules.
  • Serve SVGs with protective security headers.

Remediation Steps:

  1. Identify any references to @dicebear/core or @dicebear/initials in package.json.
  2. Run npm install @dicebear/core@9.4.3 @dicebear/initials@9.4.3 or equivalent yarn/pnpm commands.
  3. Audit code where request parameters (such as query parameters or POST bodies) are passed directly to createAvatar.
  4. Implement schema validation using tools like Zod or AJV to ensure rotate, fontSize, and fontWeight are validated as strict numbers before processing.

References

Read the full report for CVE-2026-68921 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)