CVE-2026-31860 Details
Description
Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.
A cross-site scripting vulnerability has been identified in Unhead versions prior to 2.1.11. The issue arises in the 'useHeadSafe()' composable, which is recommended by Nuxt documentation for safely managing user-generated content. The vulnerability allows for the injection of arbitrary HTML attributes, including event handlers, into server-side rendered head tags. This is possible because the 'acceptDataAttrs' function does not properly validate attribute names, allowing keys that break HTML parsing to be exploited. As a result, injected attributes can execute scripts when the corresponding events are triggered.
Users can upgrade to Unhead version 2.1.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| unjs unhead | < 2.1.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | Initial Analysis | [email protected] |
| Mar 13, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | New CVE Received | [email protected] |