DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages…
Medium CVSS 4.7
Summary
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
- https://github.com/dicebear/dicebear/releases/tag/v9.4.3
- https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45
Timeline
- nvd_ingest NVD