dicebear vulnerabilities
4 published CVEs name dicebear among the affected products.
- 4Published CVEs4 of them scored
- 4Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
dicebear · dicebear
Medium4.7 - CVE-2026-33418
@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection
dicebear · dicebear
High7.5 - CVE-2026-33311
@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options
dicebear · dicebear
Medium4.7 - CVE-2026-29112
@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions
dicebear · dicebear
High7.5