CVE-2026-33311

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. Starting in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, all affected SVG attribute values are properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Some mitigating factors limit vulnerability. Applications that validate input against the library's JSON Schema before passing it to `createAvatar()` are not affected. The DiceBear CLI validates input via AJV and was not vulnerable. Exploitation requires that an application passes untrusted, unvalidated external input directly as option values.

• CWE-79

• https://github.com/dicebear/dicebear/security/advisories/GHSA-mr9r-mww3-v6gvVendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33306bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() passw…7.5
• CVE-2026-33307Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS.…7.5
• CVE-2026-33308Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS.…5.9
• CVE-2026-33309Langflow is a tool for building and deploying AI-powered age…9.9
• CVE-2026-3331The Lobot Slider Administrator plugin for WordPress is vulne…4.3
• CVE-2026-33310Intake is a package for finding, investigating, loading and …8.8
• CVE-2026-33312Vikunja is an open-source self-hosted task management platfo…5.4
• CVE-2026-33313Vikunja is an open-source self-hosted task management platfo…4.3
• CVE-2026-33314pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-33315Vikunja is an open-source self-hosted task management platfo…4.3
• CVE-2026-33316Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-33317OP-TEE is a Trusted Execution Environment (TEE) designed as …8.7