The DiceBear avatar library interpolates the rotate option into an SVG <transform> attribute without XML escaping, and its initials component emits fontSize and fontWeight likewise unescaped. Runtime callers can supply arbitrary strings despite the numeric TypeScript definitions, allowing an attacker to break out of the attributes and inject arbitrary SVG markup. When the generated avatar is inserted inline or served as image/svg+xml, the embedded script code can execute in the page’s origin, resulting in client‑side code execution.

Versions of dicebear’s @dicebear/core and @dicebear/initials prior to 9.4.3 are vulnerable. This includes all releases of the DiceBear avatar library before the 9.4.3 update, regardless of minor or patch numbers, with the vulnerability fixed in v9.4.3 and later.

The CVSS score of 4.7 indicates a moderate severity and the EPSS is not available, so the exact exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application to pass untrusted values into the rotate, fontSize, or fontWeight options, after which the resulting SVG can be rendered by a client’s browser, enabling script execution.