CVE-2026-68921

Katalog CVE

CVSS 4.7 · Medium EPSS 0,29%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Skor CVSS 3.1 4.7 (Medium) menurut github.com.

Deskripsi (NVD)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
• https://github.com/dicebear/dicebear/releases/tag/v9.4.3
• https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45