dicebear/dicebear Security Advisories | GitStock

medium2026-09-02

CVE-2026-68921-DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

GHSA-gcr2-9v8m-gq45

high2026-03-20

CVE-2026-33418-SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

GHSA-7j2x-32w6-p43p

medium2026-03-19

CVE-2026-33311-SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

GHSA-mr9r-mww3-v6gv

high2026-03-16

CVE-2026-29112-Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter

GHSA-v3r3-4qgc-vw66