Nuxt server islands render `useHeadSafe` input without sanitisationGHSA-xfq5-w38q-pc2x

Impact

useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and <script> tags are only kept for JSON types.

When useHeadSafe is called inside a server island (a .server.vue component or page, or a component rendered with <NuxtIsland>), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. <NuxtIsland> then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.

As a result, input that useHeadSafe would normally strip (such as bodyAttrs.onload or executable <script> content) is rendered into the page. If an application passes user-controlled data to useHeadSafe inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.

<!-- components/AuthorMeta.server.vue -->
<script setup lang="ts">
const { data: author } = await useFetch('/api/author')
// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }
useHeadSafe(author.value.head)
</script>

Mitigating factors

• Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders <NuxtIsland>.
• Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called from regular (non-island) components and pages is not affected.

Affected versions

nuxt >=3.13.0, when head support for server islands was introduced. Nuxt 2 is not affected.

Patches

Fixed in [email protected]. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Patched releases apply Unhead's safe input filtering to useHeadSafe entries on the server before they are added to the island response, so islandResponse.head (including what render:island hooks see) only contains input that useHeadSafe allows.

Workarounds

Upgrade to [email protected]. If you cannot upgrade, including on Nuxt 3:

1. Call useHeadSafe with untrusted input from a regular component or page rather than from inside a server island.
2. Alternatively, validate untrusted head input against your own allowlist before passing it to useHeadSafe inside a server island.