Description
useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content.
Recommendation
Update the unhead package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.1.10
- Patched version(s): 2.1.11
References
Could your website be exposed too?
SmartScanner can check your website for Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315
- Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity - CVE-2026-31873
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026