CVE-2026-31860

Medium

Description

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.

SeverityMedium

CVSS6.1

Exploit probability—

ProductUnjs Unhead

PublishedMar 12, 2026

First seenMar 12, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

unjs unhead2.1.11 or later
unhead2.1.11 or later

Affected products

Product	Affected versions	Fixed in
unjs unhead	v < 2.1.11	2.1.11
unheadnpm	v < 2.1.11	2.1.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.