GHSA-gcr2-9v8m-gq45 is a medium-severity (CVSS 4.7) Cross-site Scripting (XSS) vulnerability in @dicebear/core. O3 Security confirms whether GHSA-gcr2-9v8m-gq45 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-gcr2-9v8m-gq45.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@dicebear/corenpm@dicebear/initialsnpmDescription
Summary
@dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup.
This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options backgroundColor, fontFamily, and textColor but did not cover rotate. @dicebear/initials has the same gap in its numeric fontSize and fontWeight options.
Impact
Cross-site scripting (CWE-79). When the generated avatar is rendered inline (for example via innerHTML) or served as image/svg+xml and opened directly, injected markup such as an <image onerror> handler runs script in the page's origin.
Exploitation requires the application to pass untrusted input into one of these options:
rotate(@dicebear/core)fontSize,fontWeight(@dicebear/initials)
In most integrations these options are set by the developer and only seed is user-controlled, so the vulnerable configuration is uncommon. Applications that use trusted, hardcoded values for these options are not at risk.
Patches
Fixed in @dicebear/core 9.4.3 and @dicebear/initials 9.4.3: the values are now XML-escaped before being written into the SVG, matching the CVE-2026-33311 fix. Upgrade to 9.4.3 or later.
The 5.x through 8.x lines share the same flaw but are end-of-life and will not receive a backport; upgrade to 9.4.3. The 10.x line is not affected.
Workarounds
If you cannot upgrade, coerce the affected options to a number before passing them to createAvatar:
rotate: Number(userInput) || 0,
Credits
Reported by @rz1027.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @dicebear/core | all versions | 9.4.3 |
| 📦npm | @dicebear/initials | all versions | 9.4.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @dicebear/core. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @dicebear/core to 9.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gcr2-9v8m-gq45 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-gcr2-9v8m-gq45 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-gcr2-9v8m-gq45. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-gcr2-9v8m-gq45 in your dependencies?
O3 detects GHSA-gcr2-9v8m-gq45 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.