GHSA-g5xx-pwrp-g3fv
NoneCVSS
—
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | unhead | 0 | 2.1.11 |
Related vulnerabilities
- CVE-2026-31860 Unhead is a document head and template manager. Same vulnerability
- GHSA-x7mm-9vvv-64w8 unhead: Streaming SSR `streamKey` injected into inline script without identifier… Also affects unhead
- GHSA-95h2-gj7x-gx9w Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in… Also affects unhead
- CVE-2026-39315 Unhead is a document head and template manager. Also affects unhead
- CVE-2026-31873 Unhead is a document head and template manager. Also affects unhead
- GHSA-5339-hvwr-7582 Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity Also affects unhead
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79