CVE-2026-33418
HighSummary
Biblioteka DiceBear do tworzenia awatarów miała lukę w funkcji `ensureSize()` w wersjach przed 9.4.2, która pozwalała na obejście ograniczenia rozmiaru SVG. Atakujący mógł dostarczyć specjalnie skonstruowane dane SVG, co prowadziło do renderowania w niekontrolowanych wymiarach, co mogło skutkować awarią z powodu braku pamięci.
Risk Assessment
Organizacje mogą być narażone na ataki typu denial of service, które mogą prowadzić do awarii aplikacji i utraty dostępności usług. Potencjalne problemy z wydajnością mogą wpłynąć na doświadczenia użytkowników oraz stabilność systemów.
Recommendation
Zaleca się aktualizację biblioteki DiceBear do wersji 9.4.2 lub nowszej, aby skorzystać z poprawionego przetwarzania XML i dodatkowych zabezpieczeń. Należy również przeprowadzić audyt kodu, aby upewnić się, że nie występują inne podobne luki.
Related vulnerabilities
- CVE-2026-76461CriticalActively exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway is due to insufficient validation in the parsing logic. An unauthenticated remote attacker could send a crafted email containing malicious SQL statements, potentially leading to execution of arbitrary SQL statements and command execution with root privileges on the underlying operating system.
- CVE-2026-76443Critical
The vulnerabilities tracked by CVE-2026-76443 relate to improper neutralization issues grouped under CWE Pillar CWE-707 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76441Critical
The vulnerabilities tracked by CVE-2026-76441 relate to improper access control issues grouped under CWE Pillar CWE-284 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76440Critical
The vulnerabilities tracked by CVE-2026-76440 relate to path traversal issues grouped under CWE Pillar CWE-23 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-20353Critical
The vulnerabilities tracked by CVE-2026-20353 relate to improper control of a resource through its lifetime grouped under CWE Pillar CWE-664 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-61534Critical
In the Yayson library for serializing and reading JSON API data in JavaScript, prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. This can result in process-wide prototype pollution, causing denial of service and logic corruption.
- CVE-2026-57145Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read or overwrite files.
- CVE-2026-57131Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-90961Critical
The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.
Original NVD description (English source)
DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of `<svg` before the actual SVG root element. When the SVG is subsequently rendered via `@resvg/resvg-js` on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes. In version 9.4.2, the regex-based approach has been replaced with XML-aware processing using `fast-xml-parser` to correctly identify and modify the SVG root element's attributes. Additionally, a `fitTo` constraint has been added to the `renderAsync` call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.