CVE-2026-39315

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-39315
Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299 Patch
https://github.com/unjs/unhead/releases/tag/v2.1.13 Product Release Notes
https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w Exploit Mitigation Vendor Advisory
https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:unjs:unhead:*:*:*:*:*:node.js:*:*
History

14 Apr 2026, 20:07

Type Values Removed Values Added
First Time Unjs
Unjs unhead
References () https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299 - () https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299 - Patch
References () https://github.com/unjs/unhead/releases/tag/v2.1.13 - () https://github.com/unjs/unhead/releases/tag/v2.1.13 - Product, Release Notes
References () https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w - () https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w - Exploit, Mitigation, Vendor Advisory
CPE cpe:2.3:a:unjs:unhead:*:*:*:*:*:node.js:*:*

13 Apr 2026, 16:16

Type Values Removed Values Added
References () https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w - () https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w -

09 Apr 2026, 18:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-09 18:17

Updated : 2026-04-14 20:07

NVD link : CVE-2026-39315

Mitre link : CVE-2026-39315

CVE.ORG link : CVE-2026-39315

JSON object : View

Products Affected

unjs

  • unhead
CWE
CWE-184

Incomplete List of Disallowed Inputs