CVE-2026-33311

Medium

Advisory

Published 19 Mar 2026In the index since 6 Sept 2026

SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
@dicebear/corenpm	7.0.4, 9.2.2	7.1.4, 9.4.1	2
@dicebear/initialsnpm	7.0.4, 9.2.2	7.1.4, 9.4.1	2

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 3 container images this version deploys carry CVE-2026-33311.

Container image	Digest	Package	Fixed in
ghcr.io/danny-avila/librechat :v0.7.7	8c68abbe1cff	@dicebear/core@7.0.4 @dicebear/initials@7.0.4	7.1.4 7.1.4

2,654

librechathajowieland

1 of the 1 container images this version deploys carry CVE-2026-33311.

Container image	Digest	Package	Fixed in
ghcr.io/danny-avila/librechat :v0.7.8	7fe76551a78e	@dicebear/core@9.2.2 @dicebear/initials@9.2.2	9.4.1 9.4.1

2,950

2 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/danny-avila/librechat :v0.7.8	7fe76551a78e	@dicebear/core@9.2.2 @dicebear/initials@9.2.2	9.4.1 9.4.1	1
ghcr.io/danny-avila/librechat :v0.7.7	8c68abbe1cff	@dicebear/core@7.0.4 @dicebear/initials@7.0.4	7.1.4 7.1.4	1