CVE-2026-68921: Cross-Site Scripting via SVG Attribute Injection in DiceBear

The avatar generation library DiceBear, specifically within the @dicebear/core and @dicebear/initials packages, contains a Cross-Site Scripting (XSS) and SVG Injection vulnerability. These packages programmatically construct Scalable Vector Graphics (SVG) assets using user-specified configuration values. Because SVGs support active content such as inline scripts, style elements, and event handlers, the structural integrity of the generated XML output must be rigidly protected.

In typical web architectures, backend services utilize libraries like DiceBear to serve dynamic user avatars on-the-fly. These applications frequently map query-string values, route parameters, or database attributes directly to library properties. If these values are not verified or sanitized, an attacker can pass raw injection strings. This exposes an attack surface where structurally destructive text payloads alter the downstream browser parser's execution flow.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-184 (Incomplete List of Disallowed Inputs). The core flaw manifests when numeric customization attributes are used inside formatting templates. Because SVGs are parsed as active XML documents, an attacker who successfully injects attributes or elements can bypass standard cross-site scripting filters.

The root cause of this vulnerability lies in an architectural assumption regarding type enforcement. The @dicebear/core and @dicebear/initials packages are authored in TypeScript, which enforces strict static typing at compile-time. Variables such as rotate in @dicebear/core, and fontSize and fontWeight in @dicebear/initials are defined explicitly as number types. Under static analysis, this typing suggests to developers that string-based payloads cannot penetrate these fields.

However, once compiled to JavaScript for execution in a Node.js or browser runtime, all TypeScript static type declarations are stripped away. JavaScript execution runtimes do not perform automatic runtime type assertion on assigned values. If an upstream application accepts raw query parameters directly from an HTTP request (such as req.query.rotate in Express, which parses strings) and passes them to the library without explicit conversion or validation, string values are fed directly into the DiceBear generation methods.

Because the library expected these properties to always be numeric, it bypassed the standard XML escaping function (escapeXml) for these specific variables, interpolating them directly as template literals. When the parser constructs the SVG markup, any unescaped string parameter containing characters like quotes or angle brackets alters the XML layout. The browser's XML parser interprets these characters as layout tokens, terminating the active attribute, and initiating a new, attacker-defined element.

To understand the structural failure, we analyze the vulnerable code path in @dicebear/core/src/utils/svg.ts. The addRotate utility interpolates the rotate parameter directly into a transform attribute string without escaping:

// Vulnerable implementation in @dicebear/core
export function addRotate(result: StyleCreateResult, rotate: number) {
  let { width, height, x, y } = getViewBox(result);
 
  return `<g transform="rotate(${rotate}, ${width / 2 + x}, ${
    height / 2 + y
  })">${result.body}</g>`;
}

A similar vulnerability exists in @dicebear/initials/src/index.ts, where numeric options like fontSize and fontWeight are interpolated directly into a text element, while other string parameters are properly escaped:

// Vulnerable implementation in @dicebear/initials
const svg = [
  `<text x="50%" y="50%" font-family="${escapeXml(fontFamily)}" font-size="${fontSize}" font-weight="${fontWeight}" fill="${escapeXml(textColor)}" text-anchor="middle" dy="${(fontSize * .356).toFixed(3)}">${escapeXml(initials)}</text>`,
].join('');

The fix, introduced in commit 922946d738c4e77ab6c412e27ede75941fec4b59, forces these numeric properties to undergo XML sanitization. The updated codebase casts the numeric variables to strings and routes them through the appropriate XML escape helper. In @dicebear/core, the code is modified as follows:

// Patched implementation in @dicebear/core
export function addRotate(result: StyleCreateResult, rotate: number) {
  let { width, height, x, y } = getViewBox(result);
 
  return `<g transform="rotate(${escape.xml(`${rotate}`)}, ${width / 2 + x}, ${
    height / 2 + y
  })">${result.body}</g>`;
}

This patch is complete and structurally sound. By applying escape.xml() or escapeXml(), any malicious character sequences such as double-quotes, ampersands, or angle brackets are safely mapped to their safe XML entity equivalents (e.g., ", <), neutralizing the injection potential before the browser parser processes the SVG.

Exploitation of CVE-2026-68921 depends on the victim application directly mapping user input to vulnerable DiceBear parameters. The attack scenario typically involves an API endpoint that generates dynamic avatars using query parameters. An attacker can construct a payload designed to escape the XML attribute boundaries and execute arbitrary JavaScript.

For the @dicebear/core vector, an attacker targets the rotate option. By passing the payload 0)"/><image href="y" onerror="alert(document.domain)"/><g transform="rotate(0, the rendered XML is manipulated as follows:

<g transform="rotate(0)"/><image href="y" onerror="alert(document.domain)"/><g transform="rotate(0, 50, 50)">[SVG BODY]</g>

When the victim loads a web page that renders this SVG inline, or accesses the raw SVG directly, the browser parses the unescaped <image> element. The browser fails to resolve the malformed source href="y", immediately triggering the onerror handler and executing the injected JavaScript code in the security context of the hosting origin.

For @dicebear/initials, an attacker targets fontSize or fontWeight with the payload 50" x="0" onload="alert(1)" data-x=". This breaks the text element context to append an active script trigger:

<text x="50%" y="50%" font-family="Arial" font-size="50" x="0" onload="alert(1)" data-x="" font-weight="400" ...>[INITIALS]</text>

The script execution context differs based on how the SVG is delivered. If the SVG is loaded via a standard <img> tag, modern browsers apply strict isolation policies that block internal script execution. However, if the SVG is rendered inline within the HTML Document Object Model, or served directly as an image/svg+xml document, the script fires, compromising the session.

The concrete impact of successful exploitation is stored or reflected Cross-Site Scripting (XSS) within the victim application's domain context. An attacker who executes arbitrary script code can read sensitive browser storage, access local credentials, hijack session tokens (including JWTs and non-HttpOnly cookies), and manipulate the active DOM.

Because the scope of the vulnerability changes from the generated XML markup to client-side script execution, the CVSS v3.1 scope metric is classified as Changed (S:C). The vulnerability has a CVSS base score of 4.7 (Medium). The score is moderate because exploitation requires high attack complexity (AC:H); the upstream developer must build an integration that allows end-users to control parameters intended to be static or programmatically restricted.

Despite the moderate CVSS score, if an application displays user-defined avatars on dashboard interfaces viewed by administrators, the exploit allows horizontal or vertical privilege escalation. The attacker could hijack administrative sessions to execute high-privilege operations, posing a significant risk in shared enterprise platforms.

Remediation requires updating all dependencies referencing @dicebear/core and @dicebear/initials to version 9.4.3 or higher. This upgrade forces structural escaping on all potentially vulnerable paths. In instances where upgrading is not immediately possible, strict input boundaries must be established.

To implement defensive validation in code, wrap any parameters passed to DiceBear in an explicit parsing and type checking structure. Rather than trusting compile-time interfaces, parse all inputs strictly using run-time validation libraries or manual casting before execution:

// Defensive coding pattern to validate inputs at the runtime boundary
function sanitizeAvatarOptions(reqQuery) {
  const sanitized = {};
  if (reqQuery.rotate) {
    const rotateVal = parseInt(reqQuery.rotate, 10);
    sanitized.rotate = isNaN(rotateVal) ? 0 : rotateVal;
  }
  if (reqQuery.fontSize) {
    const sizeVal = parseInt(reqQuery.fontSize, 10);
    sanitized.fontSize = isNaN(sizeVal) ? 50 : sizeVal;
  }
  return sanitized;
}

Additionally, apply infrastructure-level defenses such as strict Content Security Policies (CSP). Disable unsafe-inline scripts and define object-src 'none'. If serving SVGs via dynamic server endpoints, set protective HTTP response headers to isolate the generated asset:

Content-Type: image/svg+xml
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline';