Skip to content
OpenAdvisories

Package · npm

unhead

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-x7mm-9vvv-64w8

    unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

    ### Summary `createStreamableHead({ streamKey })` interpolated its `streamKey` argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that …

    unhead npm