DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials) (CVE-2026-68921)

@dicebear/core generates avatar SVGs using caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML escaping, and since runtime type checks are absent, string values can inject arbitrary SVG markup. Similarly, @dicebear/initials has the same issue with fontSize and fontWeight options. This vulnerability allows cross-site scripting (CWE-79) when the SVG is rendered inline or served as image/svg+xml. Exploitation requires untrusted input passed to these options, which is uncommon as these are typically developer-controlled. The issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3 by applying XML escaping to these values.

The vulnerability enables cross-site scripting (XSS) attacks by injecting arbitrary SVG markup that can execute scripts in the context of the page's origin. This can occur if untrusted input is passed to the rotate, fontSize, or fontWeight options and the resulting SVG is rendered inline or opened directly as an SVG image. The impact includes potential script execution leading to data theft or session hijacking. However, exploitation is limited because these options are usually set by developers with trusted values, not user input.

A fix is available in @dicebear/core and @dicebear/initials version 9.4.3 and later, which applies XML escaping to the affected options. Users should upgrade to version 9.4.3 or newer. The 5.x through 8.x versions are end-of-life and will not receive patches; upgrading is recommended. If upgrading is not possible, a workaround is to coerce the affected options to numbers before passing them to createAvatar, for example: rotate: Number(userInput) || 0.