Is CVE-2026-33311 actively exploited?

CVE-2026-33311 has no public evidence of in-the-wild exploitation as of 2026-03-24.

What is the CVSS score for CVE-2026-33311?

CVE-2026-33311 has a CVSS score of 4.7 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.

How do I patch CVE-2026-33311?

Patch guidance is available from dicebear security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-33311.

CVE-2026-33311 - remediation guidance & executive summary

Q: Which products are affected by CVE-2026-33311?

5 products: dicebear dicebear, dicebear dicebear, dicebear dicebear, dicebear dicebear, dicebear dicebear.

Description

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when applications pass untrusted input to `createAvatar()` and serve the resulting SVG inline or with `Content-Type: image/svg+xml`. Starting in versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, all affected SVG attribute values are properly escaped using XML entity encoding. Users should upgrade to the listed patched versions. Some mitigating factors limit vulnerability. Applications that validate input against the library's JSON Schema before passing it to `createAvatar()` are not affected. The DiceBear CLI validates input via AJV and was not vulnerable. Exploitation requires that an application passes untrusted, unvalidated external input directly as option values.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector: network
Complexity: high
Privileges: none
User Action: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
Weaknesses: CWE-79 · Cross-site Scripting (XSS)

Metadata

Primary Vendor: DICEBEAR
Published: 3/24/2026
Last Modified: 3/24/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

dicebear : dicebeardicebear : dicebeardicebear : dicebeardicebear : dicebeardicebear : dicebear

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-33311. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-33311

View on NIST NVD

CVE-2026-33311 vulnerability