GHSA-7j2x-32w6-p43p
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @dicebear/converter | 0 | 9.4.2 |
Related vulnerabilities
- CVE-2026-33418 DiceBear is an avatar library for designers and developers. Same vulnerability
- CVE-2026-29112 DiceBear is an avatar library for designers and developers. Also affects @dicebear/converter
- GHSA-v3r3-4qgc-vw66 Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter Also affects @dicebear/converter
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-185
- CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect… CWE-185
- CVE-2026-73425 Astro is a web framework for content-driven websites. CWE-185
- CVE-2026-64655 GitHub CLI (gh) is GitHub’s official command line tool. CWE-185
- CVE-2026-56021 Webmin allows unauthenticated attackers to read the contents of any file ending in .conf… CWE-185