{"action":"Upgrade @dicebear/initials to 5.4.4 or later.","affected":[{"fixed":"5.4.4","introduced":"5.0.0"},{"fixed":"6.1.4","introduced":"6.0.0"},{"fixed":"7.1.4","introduced":"7.0.0"},{"fixed":"8.0.3","introduced":"8.0.0"},{"fixed":"9.4.1","introduced":"9.0.0"}],"component":"@dicebear/initials","cve_ids":["CVE-2026-33311"],"ecosystem":"npm","epss":0.00188,"exploited":false,"fixed_versions":["5.4.4","6.1.4","7.1.4","8.0.3","9.4.1"],"ghsa_id":"GHSA-mr9r-mww3-v6gv","id":"tcs_01M5KG1KWFAPPKZTX0G95J3FZK","modified_at":"2026-09-10T03:51:00.638214758Z","published_at":"2026-03-19T17:49:28Z","references":["https://osv.dev/vulnerability/GHSA-mr9r-mww3-v6gv","https://github.com/dicebear/dicebear/security/advisories/GHSA-mr9r-mww3-v6gv","https://nvd.nist.gov/vuln/detail/CVE-2026-33311","https://github.com/dicebear/dicebear"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-mr9r-mww3-v6gv#npm/@dicebear/initials","url":"https://osv.dev/vulnerability/GHSA-mr9r-mww3-v6gv"}],"summary":"SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials"}