CVE-2026-68921

{
  "id": "CVE-2026-68921",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T21:17:07.540",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3."
    },
    {
      "lang": "es",
      "value": "DiceBear es una biblioteca de avatares para diseñadores y desarrolladores. Antes de la versión 9.4.3, @dicebear/core interpola la opción rotate en un atributo SVG transform sin escape XML en addRotate en packages/@dicebear/core/src/utils/svg.ts, mientras que @dicebear/initials emite de manera similar fontSize y fontWeight sin escape en packages/@dicebear/initials/src/index.ts. Los llamadores en tiempo de ejecución pueden pasar cadenas de texto a pesar de los tipos numéricos de TypeScript, salirse de los atributos e inyectar marcado SVG arbitrario. Se puede ejecutar script en el origen de la página cuando el avatar generado se inserta en línea o se sirve como image/svg+xml y se abre directamente, aunque la explotación requiere que una aplicación pase valores no confiables a estas opciones normalmente controladas por el desarrollador. Este problema está solucionado en las versiones 9.4.3 de @dicebear/core y @dicebear/initials."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dicebear",
          "product": "dicebear",
          "versions": [
            {
              "version": "< 9.4.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T11:32:11.648752Z",
          "id": "CVE-2026-68921",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dicebear/dicebear/releases/tag/v9.4.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45",
      "source": "[email protected]"
    }
  ]
}