Description
The link.href check in makeTagSafe (safe.ts, line 68-71) uses String.includes(), which is case-sensitive:
Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false.
Recommendation
Update the unhead package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.1.10
- Patched version(s): 2.1.11
References
Could your website be exposed too?
SmartScanner can check your website for Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026