{"id":"CVE-2026-31860","aliases":["GHSA-g5xx-pwrp-g3fv"],"url":"https://o3.security/vulnerability/CVE-2026-31860","summary":"Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check","details":"Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.","published":"2026-03-12T17:18:20.452Z","modified":"2026-07-15T01:48:53.844824019Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"unhead","fixedVersion":"2.1.11"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31860.json"},{"type":"ADVISORY","url":"https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31860"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:53.844824019Z"}}