@dicebear/initials vulnerabilities (npm)

2 vulnerabilities.

• @dicebear/initials npm DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials) CVE-2026-68921 Fix available 4.7 MediumAugust 20, 2026
• @dicebear/initials npm @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options CVE-2026-33311 Fix available 4.7 MediumMarch 19, 2026