GHSA-95h2-gj7x-gx9w
Medium · 6.1CVSS
6.1
EPSS
—
Published
Apr 9, 2026
CISA due date
—
The record
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | unhead | 0 | 2.1.13 |
Related vulnerabilities
- CVE-2026-39315 Unhead is a document head and template manager. Same vulnerability
- GHSA-x7mm-9vvv-64w8 unhead: Streaming SSR `streamKey` injected into inline script without identifier… Also affects unhead
- CVE-2026-31873 Unhead is a document head and template manager. Also affects unhead
- CVE-2026-31860 Unhead is a document head and template manager. Also affects unhead
- GHSA-5339-hvwr-7582 Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity Also affects unhead
- GHSA-g5xx-pwrp-g3fv Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive… Also affects unhead
- CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
- CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184