Description
createStreamableHead({ streamKey }) interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink.
Recommendation
Update the unhead package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.0-beta.5, <= 3.0.0
- Patched version(s): 3.0.1
References
Could your website be exposed too?
SmartScanner can check your website for unhead: Streaming SSR `streamKey` injected into inline script without identifier validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation - CVE-2026-69264
- Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser - CVE-2026-47430
- @asymmetric-effort/specifyjs: No redirect target validation in secureFetch - Vulnerability
- @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2026