Skip to content
dicebear
Products
| Product | CVEs | Exploited | Latest |
|---|
| dicebear | 4 | – | Aug 20, 2026 |
Exploited and recent CVEs
-
CVE-2026-68921
Medium 4.7
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
0.3%
-
CVE-2026-33418
High 7.5
@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection
0.4%
-
CVE-2026-33311
Medium 4.7
@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options
0.2%
-
CVE-2026-29112
High 7.5
@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions
0.4%