DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-68921 · Microsoft / collected KEV context

EUVD-2026-63657

GHSA-gcr2-9v8m-gq45

cve-program · CVE-2026-68921

• https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45
• https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
• https://github.com/dicebear/dicebear/releases/tag/v9.4.3

euvd · EUVD-2026-63657

• https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45
• https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
• https://github.com/dicebear/dicebear/releases/tag/v9.4.3

nvd · CVE-2026-68921

• https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
• https://github.com/dicebear/dicebear/releases/tag/v9.4.3
• https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45

osv · GHSA-gcr2-9v8m-gq45

• https://github.com/dicebear/dicebear/security/advisories/GHSA-gcr2-9v8m-gq45
• https://nvd.nist.gov/vuln/detail/CVE-2026-68921
• https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59
• https://github.com/dicebear/dicebear
• https://github.com/dicebear/dicebear/releases/tag/v9.4.3

No related operational record is retained in the current change model.