XSS in Unjs Unhead

CVE-2026-31860

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend fo…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (5.6th percentile) — read the EPSS interpretation.

Affected products

Unjs Unhead — versions < 2.1.11

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv (x_refsource_CONFIRM)