CVE-2026-33311: DiceBear Avatar Library XSS Vulnerability

CVE-2026-33311 Overview

DiceBear is a popular avatar library designed for designers and developers to generate customizable SVG avatars. A Cross-Site Scripting (XSS) vulnerability exists in DiceBear starting in version 5.0.0 where SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This vulnerability allows attackers to inject malicious scripts when applications pass untrusted input to createAvatar() and serve the resulting SVG inline or with Content-Type: image/svg+xml.

Critical Impact

Applications serving user-generated avatars inline or as SVG content may be vulnerable to XSS attacks, potentially allowing session hijacking, data theft, or malicious content injection when untrusted input reaches the avatar generation function.

Affected Products

• DiceBear versions 5.0.0 to 5.4.3
• DiceBear versions 6.0.0 to 6.1.3
• DiceBear versions 7.0.0 to 7.1.3
• DiceBear versions 8.0.0 to 8.0.2
• DiceBear versions 9.0.0 to 9.4.0

Discovery Timeline

• 2026-03-24 - CVE-2026-33311 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33311

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The core issue stems from insufficient input sanitization in the SVG generation pipeline of the DiceBear library.

When developers use the createAvatar() function to generate avatars, the library accepts various styling options including backgroundColor, fontFamily, and textColor. These user-controllable values are directly interpolated into SVG attribute positions without proper XML entity encoding. This creates an injection point where malicious JavaScript or SVG event handlers can be embedded within the generated SVG output.

The attack requires that victim applications serve the generated SVG content either inline within HTML documents or with the Content-Type: image/svg+xml header. When a browser renders this malicious SVG, any injected scripts execute within the context of the hosting domain, potentially compromising user sessions and data.

Root Cause

The root cause is the absence of XML entity encoding for user-supplied option values before they are interpolated into SVG attribute positions. The backgroundColor, fontFamily, and textColor parameters were trusted implicitly, allowing special characters like quotes, angle brackets, and event handler attributes to be injected directly into the SVG output structure.

Attack Vector

The attack vector is network-based, requiring user interaction and specific application configurations. An attacker must find an application that:

1. Accepts external or user-controlled input for avatar customization options
2. Passes this input directly to createAvatar() without validation
3. Serves the resulting SVG inline or as an SVG content type

The attacker crafts a malicious payload within one of the vulnerable parameters (such as backgroundColor) that includes SVG event handlers or script elements. When the victim application generates and serves this avatar, the malicious code executes in the user's browser context.

For example, an attacker could inject SVG event handlers through the backgroundColor parameter that execute arbitrary JavaScript when the SVG is rendered. The malicious input breaks out of the attribute context and introduces new attributes or elements that the browser interprets as executable content.

Detection Methods for CVE-2026-33311

Indicators of Compromise

• Unusual or malformed values in avatar customization parameters, particularly containing HTML/XML special characters or event handler syntax
• SVG responses containing unexpected onload, onerror, or similar event handler attributes
• Client-side JavaScript execution errors originating from avatar elements
• User reports of unexpected behavior when viewing pages containing generated avatars

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payloads in avatar customization parameters
• Monitor application logs for requests containing suspicious characters in backgroundColor, fontFamily, or textColor fields
• Deploy Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Review code paths where createAvatar() receives external input to identify vulnerable implementations

Monitoring Recommendations

• Enable verbose logging for avatar generation endpoints to capture input parameter values
• Implement anomaly detection for avatar-related requests containing non-standard color codes or font names
• Monitor browser-side error reporting for XSS-related Content Security Policy violations
• Audit third-party applications and integrations that utilize DiceBear for avatar generation

How to Mitigate CVE-2026-33311

Immediate Actions Required

• Upgrade DiceBear to patched versions: 5.4.4, 6.1.4, 7.1.4, 8.0.3, or 9.4.1 depending on your major version
• Audit all code paths where createAvatar() receives user input to ensure proper validation
• Implement input validation against DiceBear's JSON Schema before calling createAvatar()
• Review Content Security Policy headers to ensure they restrict inline script execution

Patch Information

DiceBear has released patched versions that properly escape all affected SVG attribute values using XML entity encoding. Users should upgrade to the following versions based on their current major version:

• Version 5.x: Upgrade to 5.4.4 or later
• Version 6.x: Upgrade to 6.1.4 or later
• Version 7.x: Upgrade to 7.1.4 or later
• Version 8.x: Upgrade to 8.0.3 or later
• Version 9.x: Upgrade to 9.4.1 or later

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Validate all input against DiceBear's provided JSON Schema before passing to createAvatar() - applications using this validation are not vulnerable
• Use the DiceBear CLI which validates input via AJV and is not affected by this vulnerability
• Serve generated SVGs with Content-Disposition: attachment header to prevent inline rendering
• Implement strict Content Security Policy headers that block inline script execution as a defense-in-depth measure
• Sanitize user input by allowing only alphanumeric characters and valid color codes in customization parameters

# Example: Update DiceBear to patched version
npm update @dicebear/core @dicebear/collection

# Verify installed version
npm list @dicebear/core