Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-31860 Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR… https://www.cve.org/CVERecord?id=CVE-2026-31860
Post summary
CVE-2026-31860 reveals that useHeadSafe() can be bypassed to inject arbitrary HTML attributes, enabling potential XSS or template injection via SSR.
🔴 Nuxt/Unhead XSS Bypass, #CVE-2026-31860 (Critical) https://dailycve.com/nuxt-unhead-xss-bypass-cve-2026-31860-critical/
Post summary
A new critical XSS bypass vulnerability (CVE‑2026‑31860) in Nuxt/Unhead has been disclosed, with the issue classified as XSS and marked critical.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | unjs | unhead | - | - | - |