CVE-2026-31860

The record

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.

Affected packages

Related vulnerabilities

• GHSA-g5xx-pwrp-g3fv Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive… Same vulnerability
• GHSA-x7mm-9vvv-64w8 unhead: Streaming SSR `streamKey` injected into inline script without identifier… Also affects unhead
• GHSA-95h2-gj7x-gx9w Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in… Also affects unhead
• CVE-2026-39315 Unhead is a document head and template manager. Also affects unhead
• CVE-2026-31873 Unhead is a document head and template manager. Also affects unhead
• GHSA-5339-hvwr-7582 Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity Also affects unhead
• CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
• CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79