https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33418.htmlhttps://patchthecve.com/cve/CVE-2026-33418.htmlWed, 17 Jun 2026 10:37:27 +0000HIGH 7.5: DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed byhttps://patchthecve.com/cve/CVE-2026-33311.htmlhttps://patchthecve.com/cve/CVE-2026-33311.htmlWed, 17 Jun 2026 10:37:18 +0000MEDIUM 4.7: DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVGhttps://patchthecve.com/cve/CVE-2026-29112.htmlhttps://patchthecve.com/cve/CVE-2026-29112.htmlWed, 17 Jun 2026 10:29:37 +0000HIGH 7.5: DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dicebear/converter` read the `width` and `height` attributes from the input SVG to determine the output canvas size for rasterization (PNG, JPEG, WebP, AVIF). An attacker who can supp