Cloudanix VulnDB

GHSA-mr9r-mww3-v6gv

Medium · 4.7

CVSS

4.7

EPSS

—

Published

Mar 19, 2026

CISA due date

—

The record

SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Affected packages

Ecosystem Package Introduced Fixed
npm @dicebear/core 5.0.0 5.4.4
npm @dicebear/core 6.0.0 6.1.4
npm @dicebear/core 7.0.0 7.1.4
npm @dicebear/core 8.0.0 8.0.3
npm @dicebear/core 9.0.0 9.4.1
npm @dicebear/initials 5.0.0 5.4.4
npm @dicebear/initials 6.0.0 6.1.4
npm @dicebear/initials 7.0.0 7.1.4
npm @dicebear/initials 8.0.0 8.0.3
npm @dicebear/initials 9.0.0 9.4.1

Related vulnerabilities