Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
- Severity:
- Medium
Description
useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content.
Recommendation
Update the unhead package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.1.10
- Patched version(s): 2.1.11
References
Related Issues
- Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315
- Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity - CVE-2026-31873
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
You might also like:
- Tags:
- npm
- unhead
Anything's wrong? Let us know Last updated on March 12, 2026