Unjs
5 CVEs across 4 Unjs products. Browse Unjs vulnerabilities, severities, and proof-of-concept exploits.
Unjs products with known CVEs
Unjs CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-39315 | Medium | 6.1 | 2026-04-09 | Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for render… |
CVE-2026-35209 | High | 7.5 | 2026-04-06 | defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed… |
CVE-2026-31873 | Unrated | | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive… |
CVE-2026-31860 | Medium | 6.1 | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, i… |
CVE-2025-69874 | Critical | 9.8 | 2026-02-11 | nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the int… |
CVE-2025-54387 | Critical | 9.8 | 2025-08-05 | IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check wh… |