Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M

CVE-2026-31860Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

Medium 5.3

In plain English

A medium-severity cross-site scripting in unhead from unjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	unhead	2.1.11	GHSA-g5xx-pwrp-g3fv

Affected products (as reported)

Vendor	Product	Versions
unjs	unhead	< 2.1.11

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv x_refsource_CONFIRM