GHSA-x7mm-9vvv-64w8
NoneCVSS
—
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | unhead | 3.0.0-beta.5 | 3.0.1 |
Related vulnerabilities
- GHSA-95h2-gj7x-gx9w Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in… Also affects unhead
- CVE-2026-39315 Unhead is a document head and template manager. Also affects unhead
- CVE-2026-31873 Unhead is a document head and template manager. Also affects unhead
- CVE-2026-31860 Unhead is a document head and template manager. Also affects unhead
- GHSA-5339-hvwr-7582 Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity Also affects unhead
- GHSA-g5xx-pwrp-g3fv Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive… Also affects unhead
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79