Skip to content
OpenAdvisories

Package · npm

unhead

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-39315

    Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

    Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packa…

    unjs unhead unhead npm
  • Medium 5.3
    CVE-2026-31860

    Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

    Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling us…

    unjs unhead unhead npm