Vulnerability in Unjs Unhead
CVE-2026-39315
Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (24.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.001
Affected products
- Unjs Unhead — versions < 2.1.13
Weakness classification (CWE)
References
- github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w (Exploit, Mitigation, Vendor Advisory)
- github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299 (Patch)
- github.com/unjs/unhead/releases/tag/v2.1.13 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-39315?
- CVE-2026-39315 is a medium-severity vulnerability in Unjs Unhead, classified under Incomplete List of Disallowed Inputs. CVSS score: 6.1/10. Published 2026-04-09.
- How severe is CVE-2026-39315?
- Medium severity. CVSS v3 base score is 6.1 out of 10.