THREAT OPS › Threat News › [GHSA] GHSA-gcr2-9v8m-gq45 (medium) — DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
[GHSA] GHSA-gcr2-9v8m-gq45 (medium) — DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
GHSA-gcr2-9v8m-gq45 Severity: medium CVE: CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
## Summary
`@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolated into an SVG `transform` attribute without XML-escaping. It is typed as a number, but nothing chec
Indicators of compromise
- CVE-2026-68921cve
- CVE-2026-33311cve
Original source: https://github.com/advisories/GHSA-gcr2-9v8m-gq45